On one of my machines I run Win 2008 R2 server. It has been recently updated. My RDP session is limited to my IP address only and firewall is UP. Even though the main RDP post 3389 is blocked by firewall ( IP restricted) I am getting 1000's of attempts to break in on range of different ports from 1012 to 63000. I attached the snapshot of the issue. I am getting 1000's of every day so my log file fills up pretty quick.
I am not an expert on win Servers and all I can do at this point is to ad the culprit's IP address to blocked IP's in my firewall. But the IP changes after 500 attempts regularly. My question is, how do I prevent this so I do not have to monitor this server every day? Any help appreciated.
Below is the copy of the event details one of many hack attempts:
EventData SubjectUserSid S-1-5-18 SubjectUserName MyServer12$ SubjectDomainName WORKGROUP SubjectLogonId 0x3e7 TargetUserSid S-1-0-0 TargetUserName administrator TargetDomainName MyServer12 Status 0xc000006d FailureReason %%2313 SubStatus 0xc000006a LogonType 10 LogonProcessName User32 AuthenticationPackageName Negotiate WorkstationName MyServer12 TransmittedServices - LmPackageName - KeyLength 0 ProcessId 0x3114 ProcessName C:\Windows\System32\winlogon.exe IpAddress 18.104.22.168 IpPort 1214