I need some help.
I am seeing a lot of attempted logins in my Security Log.
This is a fairly new Godaddy VPS Server running Windows 2008 R2.
The attends are with various user IDs, that do repeat.
The log entry looks like this:
Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 8/23/2019 5:43:31 PM Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer: s132-148-82-95.secureserver.net Description: An account failed to log on.
Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed: Security ID: NULL SID Account Name: Administrator Account Domain:
Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc000006a
Process Information: Caller Process ID: 0x0 Caller Process Name: -
Network Information: Workstation Name: MSTSC Source Network Address: - Source Port: -
Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
As you can see it doesn't give a caiier IP address.
And Microsoft says NTLM is not tied to any port.
I have tried blocking ports on TCP 1-79, 81-3388, 3390-20000, and in UDP 1-20000 in the firewall. But that doesn't stop the attempts.
I RDP into the server and it's only allowed from my IP address in the firewall.
I don't know what to try next.
Should I ever try to block them or should I just ignore them?