I have public-facing Windows Server 2016 virtual machine. Remote desktop port was changed from default to some number over 20,000.
There is nothing of interest hosted on this VM. I just use it as a test bed for software development.
However, I still get daily Audit Failures (Event ID 4625) in Windows Event Log.
Source Network address is usually in Europe (I am in US and no user traffic is expected from Europe or anywhere. As I mentioned above, VM is not really hosting anything but it does have IIS running). User Names look like they are coming from some kind of dictionary of often used names, including Windows default accounts like Administrator (which is renamed on my VM)
Is there a way to tell which protocol they are using? That is, is this Remote Desktop or could this be something else (are they trying to browse network shares? I haven't created any)? I can't tell from looking at Event Log.
Before I changed default Remote Desktop port to the number in 20,000-plus range I wouldn't be surprised if this was Remote Desktop. But now I find it difficult to believe. Would someone actually scan all the ports up to 20,000 and above just to find an open Remote Desktop port on random IP address?