There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those RDP Logs and I see a RDP login attempt originating from the loopback address, 127.0.0.1 or the actual external IP Address of the server
The user it's attempting to log in as is SERVER$ and I've actually recieved log in success reports from it as well. Is this actually normal Windows behavior or did I just get pwned?