Есть терминал, вывешенный на 3389 в инет. Каждую минуту в лог пишется по 6-8 ивентов на тему как показано.
Как можно блокировать эти попытки?
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
....
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: *****
Description:
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: *****
Account Domain: *****
Logon ID: 0x3e7
Logon Type: 10
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: adm
Account Domain: *****
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0x3140
Caller Process Name: C:\Windows\System32\winlogon.exe
Network Information:
Workstation Name: *****
Source Network Address: 195.24.234.132
Source Port: 56123
Detailed Authentication Information:
Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
