Common network server Remote Desktop Connection attack and frequent shutdown solution cases

Recently found a server placed on the public network frequent automatic restart, almost every remote login will see the system unexpectedly shutdown prompt and asked to select the reason, open the Event Viewer, found that there are a large number of the same class of unusual events, such as:

occur frequently for 15-17 seconds, and then look at the properties of the event such as:

Tip: "The remote session from client name a exceeded the maximum number of failed logins allowed. Forced termination of Session ".

It is known that some people try to log the server through the program, the server is tired of the shutdown. The following processing:

1 [hkey_local_machine\system\currentcontrolset\control\terminal  SERVER\WDS\RDPWD\TDS\TCP] PORTNUMBER 

2.also in Registry Editor, find hkey_local_machine\system\currentcontrolset\control\terminal server\winstations\ Rdp-tcp, find the portnumberon the right andmodify it to the same port number as above.

3, firewall to increase the port number of the inbound rules, restart the computer.

The next day to Telnet, log in In addition to the "IP: Port number", found no further prompt to shut down unexpectedly, view events, Tian Qing Ning.

Common network server Remote Desktop Connection attack and frequent shutdown solution cases