I have public-facing Windows Server 2016 virtual machine. Remote desktop port was changed from default to some number over 20,000.

There is nothing of interest hosted on this VM. I just use it as a test bed for software development.

However, I still get daily Audit Failures (Event ID 4625) in Windows Event Log.

Source Network address is usually in Europe (I am in US and no user traffic is expected from Europe or anywhere. As I mentioned above, VM is not really hosting anything but it does have IIS running). User Names look like they are coming from some kind of dictionary of often used names, including Windows default accounts like Administrator (which is renamed on my VM)

Is there a way to tell which protocol they are using? That is, is this Remote Desktop or could this be something else (are they trying to browse network shares? I haven't created any)? I can't tell from looking at Event Log.

Before I changed default Remote Desktop port to the number in 20,000-plus range I wouldn't be surprised if this was Remote Desktop. But now I find it difficult to believe. Would someone actually scan all the ports up to 20,000 and above just to find an open Remote Desktop port on random IP address?


If you really want to know, you can use Advanced Audit Policy and enable auditing for Windows Firewall. You can configure it to log security events every time a connection is permitted (and/or denied) through the Windows firewall.

That being said, you should never put any host directly on the internet without knowing exactly which firewall ports are open. For example, you should either be using Windows firewall or the firewall provided to you by Azure networking and see to it that only your high-numbered custom RDP port is exposed. Then there is no question that any time anyone hits your server, you know that the protocol has to be RDP because you know that's the only port that is open.

wfp audit

If you don't want to enable auditing of Windows firewall, you can also take a gander at the RemoteDesktopServices-RdpCoreTS event log. It also logs connection attempts with IP addresses.

rdp log

And yes people have been scanning hosts on the internet for as long as there's been an internet. Just to see what's out there.

  • To my surprise checking RemoteDesktopServices-RdpCoreTS event log confirmed all Audit Failures were failed RD connection attempts. Does it mean they actually tried correct port? Or would an entry be generated even if wrong (default) port was used? Also: Windows Firewall is enabled (of course) but my host doesn't offer any firewalls outside that (like Amazon AWS or Azure do). Will look into Advanced Audit Policy (does it log port # as well?). – Joe Schmoe Dec 29 '17 at 22:25
  • 1
    Oh, sorry for mentioning Azure then - I somehow got the impression that you were using Azure IaaS. Anyway, yes those events in the Remote Desktop log indicates that the ne'er-do-wells have figured out your custom RDP port. :) It does not mean that they successfully authenticated though. Only that they established a TCP connection. So use only very strong passwords on that box. :) Also yes the audit logging does mention port number. Added a screenshot to the post. – Ryan Ries Dec 30 '17 at 0:32
  • I see where you are coming from. But think about it - scanning TCP ports with a multi-threaded process can be very fast - takes a few seconds. And a lot of that scanning is probably done by infected machines. After the scan is complete they'll most likely end up with only a handful of ports. And once a port is determined open, they can pretty much figure out what it is - or worst case scenario attempt the most common protocols. What are servers going to most likely provide? It'll be RDP, SSH and other common remote management protocols so it's probably easier than it sounds. – Lucky Luke Jan 4 '18 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.