up vote 0 down vote favorite
share [g+] share [fb]

I am new to managing a hosted Windows vps and in the past 4 days my security event log shows about 35,000 Events as: Audit Failure "An account failed to log on." These appear to be recurring attempts to gain access using a variety of user names. This is a Win 2008 R2 vps.

A few questions: 1 - Is this normal to receive this level of login attempts? 2 - Is there any way to block this? 3 - What is the best way to prevent one of these attempts from gaining access and taking over my server?

Any suggestions welcomed - thanks.

link|improve this question
50% accept rate
feedback

2 Answers

up vote 1 down vote accepted

If your computer has a publicity accessible IP, then it's in the wild and yes, it's normal. This is a sad & unfortunate reality.

What services do you have exposed to the internet? smb/cifs/rdp/rras ? You'll need to limit your attack surface by shutting down services that aren't needed, or beefing up your firewall rules.

link|improve this answer
Well - the services running and allowing public through the firewall right now are core networking, DFS Management, RDP, HTTPS, HTTP, and a Subversion server. Can any of these be shut down? – asinc Dec 8 '09 at 23:30
feedback
up vote 0 down vote

Firewall off the RDP port so that only your IP can connect to it (assuming you have a static IP).

link|improve this answer
How do I do that or where would I set this? – asinc Dec 8 '09 at 23:27
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.