Win Server 2008 RDP Attack
On one of my machines I run Win 2008 R2 server. It has been recently updated. My RDP session is limited to my IP address only and firewall is UP. Even though the main RDP post 3389 is blocked by firewall ( IP restricted) I am getting 1000's of attempts to break in on range of different ports from 1012 to 63000. I attached the sanpshot of the issue. I am getting 1000's of every day so my log file fills up pretty quick.

I am not an expert on win Servers and all I can do at this point is to ad the culprit's IP address to blocked IP's in my firewall. But the IP changes after 500 attempts regularly. My question is, how do I prevent this so I do not have to monitor this server every day? Any help appreciated.

Below is the copy of the event details one of many hack attempts:

    EventData 
    
      SubjectUserSid S-1-5-18 
      SubjectUserName MyServer12$ 
      SubjectDomainName WORKGROUP 
      SubjectLogonId 0x3e7 
      TargetUserSid S-1-0-0 
      TargetUserName administrator 
      TargetDomainName MyServer12 
      Status 0xc000006d 
      FailureReason %%2313 
      SubStatus 0xc000006a 
      LogonType 10 
      LogonProcessName User32  
      AuthenticationPackageName Negotiate 
      WorkstationName MyServer12 
      TransmittedServices - 
      LmPackageName - 
      KeyLength 0 
      ProcessId 0x3114 
      ProcessName C:\Windows\System32\winlogon.exe 
      IpAddress 27.151.120.145 
      IpPort 1214 

![Snapshot][1]


  [1]: http://i.stack.imgur.com/ktPTs.jpg
Win Server 2008 RDP Attack
===

On one of my machines I run Win 2008 R2 server. It has been recently updated. My RDP session is limited to my IP address only and firewall is UP. Even though the main RDP post 3389 is blocked by firewall ( IP restricted) I am getting 1000's of attempts to break in on range of different ports from 1012 to 63000. I attached the sanpshot of the issue. I am getting 1000's of every day so my log file fills up pretty quick.

I am not an expert on win Servers and all I can do at this point is to ad the culprit's IP address to blocked IP's in my firewall. But the IP changes after 500 attempts regularly. My question is, how do I prevent this so I do not have to monitor this server every day? Any help appreciated.

Below is the copy of the event details one of many hack attempts:

    EventData 
    
      SubjectUserSid S-1-5-18 
      SubjectUserName MyServer12$ 
      SubjectDomainName WORKGROUP 
      SubjectLogonId 0x3e7 
      TargetUserSid S-1-0-0 
      TargetUserName administrator 
      TargetDomainName MyServer12 
      Status 0xc000006d 
      FailureReason %%2313 
      SubStatus 0xc000006a 
      LogonType 10 
      LogonProcessName User32  
      AuthenticationPackageName Negotiate 
      WorkstationName MyServer12 
      TransmittedServices - 
      LmPackageName - 
      KeyLength 0 
      ProcessId 0x3114 
      ProcessName C:\Windows\System32\winlogon.exe 
      IpAddress 27.151.120.145 
      IpPort 1214 

![Snapshot][1]


  [1]: http://i.stack.imgur.com/ktPTs.jpg