re: Unfettered access to port 3389

petieg — Tue, 24 Jun 2008 11:11:49 GMT

did you ever try the free SecureRDP? Simple, easy lockdown of rdp by ip address, computer name, etc.

re: Unfettered access to port 3389

the_angry_angel — Tue, 24 Jun 2008 10:44:40 GMT

In some instances it maybe politically troublesome to lock down RDP. In these instances, where you have no choice there are additional steps you can take to help, aside from altering the port number.

In the given example tsgrinder script you will notice that the username argument doesn't appear to be used, which means it's grinding against the username 'administrator'. Many brute attacks rely on this account, so renaming the administrator account to something else helps immeasurably.

Secondly setup your server/domain to log failed logons and setup some monitoring. If you get it setup right you can take automated action to close 3389 to the attacking IP(s), or you can simply inform the admin via email who can take manual action to prevent the attack.