Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to managing a hosted Windows vps and in the past 4 days my security event log shows about 35,000 Events as: Audit Failure "An account failed to log on." These appear to be recurring attempts to gain access using a variety of user names. This is a Win 2008 R2 vps.

A few questions: 1 - Is this normal to receive this level of login attempts? 2 - Is there any way to block this? 3 - What is the best way to prevent one of these attempts from gaining access and taking over my server?

Any suggestions welcomed - thanks.

share|improve this question
up vote 1 down vote accepted

If your computer has a publicity accessible IP, then it's in the wild and yes, it's normal. This is a sad & unfortunate reality.

What services do you have exposed to the internet? smb/cifs/rdp/rras ? You'll need to limit your attack surface by shutting down services that aren't needed, or beefing up your firewall rules.

share|improve this answer
Well - the services running and allowing public through the firewall right now are core networking, DFS Management, RDP, HTTPS, HTTP, and a Subversion server. Can any of these be shut down? – asinc Dec 8 '09 at 23:30

Firewall off the RDP port so that only your IP can connect to it (assuming you have a static IP).

share|improve this answer
How do I do that or where would I set this? – asinc Dec 8 '09 at 23:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.