Help securing Windows server

Comments

• NDTN Member, Patron Provider, Top Host

  November 2020

  1. Keep your Windows updated
  2. Change the default listening port of the RDP, we have a guidance here: https://greencloudvps.com/billing/knowledgebase/26/How-to-change-the-default-port-for-Remote-Desktop-on-your-VPS.html
  3. Limit access to specific IP addresses, just like you said - openvpn IP.

  Thanked by 4NewToTheGame TimboJones kp93 Ramsterdam
• NewToTheGame Member

  November 2020 edited November 2020

  So the attack is more of a flood, many of the login attempts do not get blocked by cyberarms, I am going to assume they are using blank credentials, but those do not appear in the standard terminal services event log, not sure where you find the attackers ip
• interservermike Member, Patron Provider

  November 2020

  RDP Defender by Softpedia is a small software package that secures up RDP. It is free.

  Thanked by 3TimboJones NewToTheGame coreflux
• TimboJones Member

  November 2020

  @NewToTheGame said:
  So the attack is more of a flood, many of the login attempts do not get blocked by cyberarms, I am going to assume they are using blank credentials, but those do not appear in the standard terminal services event log, not sure where you find the attackers ip

  In later server OS', I think you need to make a change to a default setting to expose the IP in the Windows logs that Cyberarms parses. A screenshot of RDP Defender references the change.

  But changing RDP port and using your home IP as the only allowed source IP and you're good. Just make sure you have a console available or another way in like Remote Utilities.

  Thanked by 1NewToTheGame
• NewToTheGame Member

  November 2020

  @TimboJones said:

  @NewToTheGame said:
  So the attack is more of a flood, many of the login attempts do not get blocked by cyberarms, I am going to assume they are using blank credentials, but those do not appear in the standard terminal services event log, not sure where you find the attackers ip

  In later server OS', I think you need to make a change to a default setting to expose the IP in the Windows logs that Cyberarms parses. A screenshot of RDP Defender references the change.

  But changing RDP port and using your home IP as the only allowed source IP and you're good. Just make sure you have a console available or another way in like Remote Utilities.

  Thanks for the suggestions, Windows login audit is on, but blank credentials don't show in the to event log. Firewall logging is on as well, I will keep looking
• seriesn Member

  November 2020

  • Change default username from "Administrator" to something non generic:. https://support.microsoft.com/en-us/help/816109/how-to-rename-the-administrator-and-guest-account-in-windows-server-20
  • Change RDP Port to something non standard: https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port
  • Install firewall such as : https://cyberarms.net/ to protect your service
  • Easy bruteforce protector: https://github.com/neil-sabol/EZWinBan

  Thanked by 4plumberg kp93 NewToTheGame rtsh
• NewToTheGame Member

  November 2020

  @seriesn said:

  • Change default username from "Administrator" to something non generic:. https://support.microsoft.com/en-us/help/816109/how-to-rename-the-administrator-and-guest-account-in-windows-server-20
  • Change RDP Port to something non standard: https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port
  • Install firewall such as : https://cyberarms.net/ to protect your service
  • Easy bruteforce protector: https://github.com/neil-sabol/EZWinBan

  Everything but the port number has been changed, cyberarms IDDS is already running.
• active8 Member

  November 2020

  1. Open RDP port only for your own (static) IP or VPN ip address in your firewall
  2. Program RDP Guard (https://rdpguard.com/) is not free but work flawless has even County block options, used in the past and worked well
• TimboJones Member

  November 2020

  @seriesn said:

  • Install firewall such as : https://cyberarms.net/ to protect your service

  Cyberarms technically isn't a firewall itself, it uses Windows logs to add rules to the built-in Windows firewall rules.

  Thanked by 1seriesn
• NewToTheGame Member

  November 2020

  Could anyone recommend a free net Monitor for Windows?, I need to see ip, protocol, port and data Rx TX, that way I can analyze what is going on
• TimboJones Member

  November 2020

  @NewToTheGame said:
  Could anyone recommend a free net Monitor for Windows?, I need to see ip, protocol, port and data Rx TX, that way I can analyze what is going on

  You mean Wireshark?