Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to managing a hosted Windows vps and in the past 4 days my security event log shows about 35,000 Events as: Audit Failure "An account failed to log on." These appear to be recurring attempts to gain access using a variety of user names. This is a Win 2008 R2 vps.

A few questions: 1 - Is this normal to receive this level of login attempts? 2 - Is there any way to block this? 3 - What is the best way to prevent one of these attempts from gaining access and taking over my server?

Any suggestions welcomed - thanks.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

If your computer has a publicity accessible IP, then it's in the wild and yes, it's normal. This is a sad & unfortunate reality.

What services do you have exposed to the internet? smb/cifs/rdp/rras ? You'll need to limit your attack surface by shutting down services that aren't needed, or beefing up your firewall rules.

share|improve this answer
    
Well - the services running and allowing public through the firewall right now are core networking, DFS Management, RDP, HTTPS, HTTP, and a Subversion server. Can any of these be shut down? –  asinc Dec 8 '09 at 23:30
add comment

Firewall off the RDP port so that only your IP can connect to it (assuming you have a static IP).

share|improve this answer
    
How do I do that or where would I set this? –  asinc Dec 8 '09 at 23:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.