Server 2008 adit logs show 1000's of Failure Logon Attempts to the `Admin` account

Question

I was just going through the logs of one of my servers and I noticed there are a ton of failed logon attempts for username Administrator, owner and Admin. I assume that these are bots since there is almost one every second, but my question is what do you normally do about this?

I am new to server security, but from what I have been reading most people don't seem too concerned with this type of thing.

When you try to remote desktop into a windows system, don't you only have a few tries before being locked out for a bit? I have 63 minutes worth or failed logon attempts every ~1.3 seconds from the same IP address 69.41.252.68.

Answer 1

Account Lockout Policy settings aren't enabled by default. You'll need to manually enable them. If this is a standalone server (it sounds like it is) you can enable Account Lockout Policy settings by editing the Local Security Policy from within Administrative Tools. If this server is joined to a domain you can enable Account Lockout Policy settings by editing the Local Security Policy from within Administrative Tools or by using Group Policy within the domain.

It sounds like these events are being generated by incoming RDP connection attempts (although you haven't specified that). You can take a number of approaches to dealing with this:

A. Block the offending ip address(es) at your network router or firewall.

B. Block the offending ip address(es) in the Windows Firewall by setting the Scope of the RDP-in rule to allow connections only from a defined set of ip addresses or networks.