We have a Windows Server 2016 webserver that acts as a hosting server and receives constant login attempts. Fortunately they all fail but it's filling our SIEM with alerts for repeated login attempts. On all our other servers, we locked down the RDP port so that it can only be accessed from a select set of IP addresses. This blocks the automated RDP login attempts and the logs are quiet.
The troublesome server also has the RDP port scoped to limited IP addresses but we still have constant failed login attempts. Each login attempt is using a different port which is why the firewall isn't blocking it. I've installed RDPGuard which is partially successful in blocking the IP addresses but I've also noticed that the IP addresses are rotating for each request so it's not as effective as I'd like.
We don't use Active Directory. The administrator account is disabled. The user account tends to almost always be 'administrator'.
An example of the log entry is below:
An account failed to log on.
Subject: Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: administrator
Failure Reason: Unknown user name or bad password.
Sub Status: 0xC000006A
Caller Process ID: 0x0
Caller Process Name: -
Workstation Name: -
Source Network Address: 126.96.36.199 <--- This keeps changing
Source Port: 65149 <--- This keeps changing
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
Which is always paired with the following event:
The computer attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: administrator
Error Code: 0xC000006A
Is there a configuration setting that is allowing these login attempts that needs to be changed?
Could changing the firewall to block all incoming ports (except a whitelist of ports like 443, 80, 21, etc) help?