1

We had couple of dedicated servers rented on 1and1 hosting. In past we had situation where our server has got compromised and intruders were able to hack into the Windows 2003 standard edition and been able to manipulate the server for malicious purposes.

Once it was compromised for sending out mass spam emails. (this has happened multiple times and after that we changed RDP port to other than default we did not have any other port than smtp, 80 and 443 + rdp, but even after change of our RDP port we have got hacked once)

Another Windows 2003 Ent edition was hacked which was hosted in our unmanaged co-location and was hacked by some Palestine hacker group just to show that server had been compromised and replace website/portal with their logo.

Now in both cases we have noticed that hackers were able to create windows user on the server and their login events were recorded in the security even log.

Now we have limited users and removed all old or unused users from the server but can anyone tell me that how can we stop and make Windows Server OS secure enough that some hacker could not remotely create new user and gain access to Windows system.

Improve this question
1
  • 4
    If the server was hacked, and especially when they had privileges to create new users, then there is only one solution: Wipe the complete disk and reinstall. Fully patch the machine to date (and every month again), use strong passwords for all users. Allow as few users as possible.
    – jippie
    May 26, 2012 at 7:43

1 Answer 1

Reset to default
1

I would recommend taking a look at the detailed guide created by the NSA

http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml#microsoft

They compile best practices and were written with the help of Microsoft.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.