Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I just had a look through our web server error logs, and Terminal services is reporting:

"Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was forcibly terminated."

Hundreds of times, every 10.5 seconds or so for a period of about 5-10 minutes, once at 2pm yesterday and once again at about 1am this morning.

We CURRENTLY have RDP open to the outside, as I am just completing the setup and now and then I/Others need to jump on from an outside office/location (VPN isn't an option)

As these are so regular, am I right in assuming that they may be the result of some sort of dictionary attack? or could something like an internal admin's hung session cause such a mass of events?

(Win Server 2008 R2)

share|improve this question
    
Not necessarily a hacking attempt, but definitely something to block. –  PatomaS Oct 31 '12 at 11:49
    
Did anybody find a way to stop these attacks/blocking attempts? Would prefer any solution without changing the RDP port(default 3389) coz thats something i need to avoid. Have to keep the RDP port open too. :( Is there any other way? –  user20233 Nov 28 '12 at 10:04
    
no, in the end we blocked external RDP completely at the firewall. –  Darkcat Studios Nov 28 '12 at 15:49
add comment

1 Answer

Yeah, sounds like it. Normally in the logs it will advise of an IP address, this may be a good indicator.

I had almost identical (but mine was via a SQL Server weakness and an open port), in the end the attacks were so constant it stole all the bandwidth (port flooding I think is the term)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.