I have a new install of Windows Server 2012 on a VM and I intend to use Wail2ban (https://github.com/glasnt/wail2ban) to try and block people attacking the server.
I have successfully added Wail2ban and I have this working now, but it certainly was not straight forward. There we are few settings I needed to change in gpedit.msc in order to get the IP of the attacking host to actually show up in the Event Viewer. Originally no source address was shown in the event.
By changing about three settings I now have this working, but I am now unable to access the shared files on the server.
One setting I had to change is gpedit.msc->Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options->Network Security: restrict NTLM: Incoming NTLM traffic I have set this to "Deny All Accounts" and I do get the attacker ip in Event viewer but I cannot access shared files. With the other settings "Allow All"/"Deny all Domains" I do not get the IP in the Event viewer but I can access shared files.
Does anyone have any ideas how I can get both working or is this just a no go?