2

I noticed that my uplink bandwidth during a speed test seemed reduced, so I started investigating my network activity with Resource Monitor. I found that svchost.exe was transmitting ~2kB/sec (~16kb/s) to 209.7.101.10, reportedly Illinois Century Network, a backbone provider in Springfield, IL.

With process explorer I discovered that this svchost.exe PID was tied to an RDP session while I was logged in locally. I disabled remote desktop access and the process using the bandwidth immediately died. Of course my RDP port is open to the world, by design, so that I can access it away from home.

It appears clear to me that there were unauthorized attempts to access my PC remotely. How can I determine whether or not an RDP login attempt was successful?

I've checked in the TerminalServices-RemoteConnectionManager Operational logs and I can see what appears to be a smattering of common user names: "forms", "cecilia", "voicemail", "diane", etc. None of those accounts exist on my machine. Here's a sample entry:

Remote Desktop Services: User authentication succeeded:

User: diane
Domain: 
Source Network Address: 209.7.101.10

Mitigation

In the meantime, I've disabled remote desktop access. If I choose to restore it, I'll likely change the default port number at minimum. Anyone know how easy that would be to defeat via port scanning? A more secure method would be setting up SSH tunneling, though the Microsoft Android RDP client app doesn't support this.

  • 1
    Related: serverfault.com/questions/461396/… – deviantfan Nov 17 '16 at 3:27
  • 2
    20 kbps isn't a lot; are you sure someone was logged in, and not just trying to log in a bunch of times? I'd check the Security log for remote logon events to see if someone actually succeeded or not, and what account they got in with, if any. – Reid Rankin Nov 17 '16 at 4:04
  • @ReidRankin thanks very much for the clue. You were absolutely right about it likely being attempted intrusions rather than successful ones. See the edits to my question. Note though that the "Security" log is not the place to identify attempted RDP logins. They are found in TerminalServices-RemoteConnectionManager Operational logs. Also, not that it makes a big difference, but the bandwidth was 20kB/s (160kb/s) not 20kb/s. – glenviewjeff Nov 17 '16 at 15:35
1

Non-server editions of Windows only allow one user to be logged in at a time, so a successful login via RDP will kick you out and you will probably notice.

You can also find successful RDP login in the Security event logs by looking at the logon type. It is possible to use an XPath filter for this.

The bandwidth usage you're seeing is probably RDP serving the login screen. You can change the settings to require Network Level Authentication which validates the credentials before a connection can be made (no login screen).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.