154 reputation
312
bio website
location
age
visits member for 5 years, 9 months
seen Jan 19 at 21:31

Nov
26
awarded  Excavator
Nov
26
revised What is the difference between SQL Server standard and web edition?
corrected spelling
Nov
26
suggested approved edit on What is the difference between SQL Server standard and web edition?
Sep
2
awarded  Popular Question
Nov
8
awarded  Tumbleweed
Jan
8
awarded  Popular Question
Oct
3
revised Large number of security events in the log
specified that the workaround doesn't work unless an option is enabled
Oct
2
revised Large number of security events in the log
link to article with solution
Oct
2
comment Large number of security events in the log
Hardware firewall is out of the budget right now. We have been running other servers in this configuration (without a hardware firewall) for years without problems -- I guess you could argue we were lucky. We run penetration/vulnerability tests all the time.
Oct
2
comment Large number of security events in the log
Servers are hammered by bots with or without a firewall. There's nothing listening on those ports anyway. The firewall stops those attempts, but even without a firewall they wouldn't be successful.
Oct
1
comment Large number of security events in the log
Not sure if needed, but based on the article you linked to I also ran: auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
Oct
1
accepted Large number of security events in the log
Oct
1
comment Large number of security events in the log
Doing it from the GUI didn't seem to work, but this did the trick: "netsh firewall set logging droppedpackets=disable" It did complain that the command is deprecated, but it worked. Thanks!
Oct
1
comment Large number of security events in the log
I disabled the logging of dropped packets (not sure how I didn't notice that settings before), but it doesn't look like it's working (although I did get a "450 - A Windows Firewall setting was changed" event)... investigating...
Oct
1
comment Large number of security events in the log
I'll look into it, thanks. We don't have a domain, hopefully this will work without one.
Oct
1
comment Large number of security events in the log
It has been going on for almost a week now though...
Oct
1
comment Large number of security events in the log
My understanding is that the firewall (software, not a hardware firewall) is blocking these requests and logging every single attempt in the security branch of the events viewer. I used grc.com to test these ports and only the right ports are open, so nothing goes through.
Oct
1
revised Large number of security events in the log
clarification over the event entry
Oct
1
comment Large number of security events in the log
That's what it's doing. The entries in the log are notifications from Windows Firewall that those packets have been dropped. I'll update the question to point this out.
Oct
1
comment Large number of security events in the log
It's a web-server, so it has to.