Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A new client of ours has a legacy web app on Win Server 2008 R2 and when we started diagnosing the event logs, there were multiple ip's in China trying to hit both their sa sql account and trying to rdp into the box (every 2 or 3 seconds for days on end).

So for some quick clarification: 1) The web app doesn't use the sa account and the sa pwd is secure (and not trivial) 2) The sql server is on the same box (for the immediate future) that the web app is on. 3) We've blacklisted all the offending IP addresses so far, but there's no way these guys will stop and in fact it usually only takes them a few hours to get a new IP.

As I am a dev and we usually use Azure to avoid some of these infrastructure issues, some of this is a little new to me and I was firstly wanting to see if there was some blatant best practice that we're missing.

Secondly, and to the heart of the title, is there away to automate the IPSec rules? Since the only reason there would be a reference to an invalid login attempt on the sa account would be a hacking attempt, could I set something up to say "if you see a message come through the event log with 'There has been an invalid login attempt with user 'sa'', then it's a hack attempt and add the offending IP address to the blacklist".

share|improve this question
1. Firewall in FRONT of the server, 2. Secure the server properly instead of resorting to mass blocking of IP blocks, 3.… – TheCleaner Sep 5 '13 at 21:11
by your number 2) secure the server properly, you're referring to shutting down unnecessary ports and such? or something else... We're closing out ports now as well... Everything was originally wide open when we got it – Rikon Sep 5 '13 at 21:15
Meaning (IMO) a Windows server shouldn't be sitting wide open to the web. Ports locked down, services disabled, stateful firewall in place in front of the server only allowing appropriate traffic to pass inside, securing SQL, apps, OS using best practices, etc. – TheCleaner Sep 5 '13 at 21:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.