IIS Web Login Protection Settings
Enable IIS web login protection on the Windows server hosting IIS. These settings apply to built-in IIS authentication, including Basic, Digest and Windows Authentication (NTLM).
RdpGuard handles these attempts through its RDP Protection module, which reads failed Windows logon events with Event ID 4625. Despite the module's name, these events can also come from IIS authentication. Protection works with HTTPS because detection uses the Windows Security log, without decrypting web traffic.
This requires IIS login failures to generate 4625 events containing the client IP address on the server running RdpGuard. Application login forms, such as a WordPress login page, are not automatically covered by this method unless their failures generate these Windows logon events.
Install RdpGuard on the IIS server, then check the following settings.
Configure the recommended audit policy settings. Enable Success and Failure auditing for Audit Logon so Windows records logon events.
Open RdpGuard Dashboard and click RDP under Monitored protocols. RDP Protection is enabled by default.
Click RDP to open the settings used for Windows logon detection. In RDP Settings, make sure Enable RDP protection is selected. If you change the setting, click Save to apply it.
Keep RDP protection enabled to detect IIS login failures recorded as Windows logon events. Check a failed IIS login in Event Viewer, Windows Logs, Security. Look for Event ID 4625 and confirm that Source Network Address contains the client's IP address. See Microsoft's Event 4625 reference for field descriptions.
If the event is missing, its source address is empty, or it contains a loopback or proxy address, RdpGuard cannot identify the original client from that event. Check the IIS authentication and audit configuration before relying on this protection. Also review any RDP detection exclusions: they apply to IIS login events processed by this module as well.
To adjust the failed-attempt limit or block duration, open Tools, Options, General. These settings are shared with other protection modules.
By default, RdpGuard blocks all server ports for blocked IP addresses. If you have restricted blocking to selected ports in Advanced Blocking Settings, make sure it covers your website's ports. Blocking only RDP port 3389 will leave HTTP and HTTPS accessible.
RdpGuard protects:
- Remote Desktop
- MS-SQL Server
- FTP Protocol
- HTTP Protocol
- IMAP Protocol
- POP3 Protocol
- SMTP Protocol
- IIS Web Login
- MySQL Server
- ASP.NET Forms
- RD Web Access
- VoIP (SIP Protocol)
- SSH Protocol
- MS VPN (RRAS)
"This sotware is really great. It's a relief. Because my server is constantly under attack. Thanks RdpGuard" - Joaquim De Sousa Marques
"Nice product. I used to implement something similiar in a low-tech and cumbersome manner via a script called TSBlock (not mine). This makes it much easier and is well worth the pricetag for SMB's." - J. Johnson
"Absolutely amazed at your product. We are a church in the North Dallas area, and I discovered this morning multiple failed logon attempts via our Remote Access Server. A friend suggested your product, so I immediately downloaded the trial. It had a list of about five blocked IP addresses in minutes, and that was enough to lead me to push the BUY button. Over the past 10-15 minutes the list is now about thirty with at least a third being international attempts to break into our system. Thanks for a great product. You may have just saved us much grief." - John Hallford
"Love the software. RDP on our Windows servers is just ridiculous. We would block it in the router but we have lots of old-time customers that would have issues." - Scott Hirsch
"Love the software! Makes it easier than tailoring VB Scripts!!" - Nick Brennan
"It's a great product - really stopping those RDP attackers :-)" - Dave, UK
"First of all: Your application is very (!!!) useful and I like it very much securing my 2012 R2 server. RdpGuard is the best solution, I found on the market and after 10 minutes of testing it I ordered the fully-featured version. :-)" - Carsten Baltes