IIS Login Brute-Force Protection with RdpGuard - Basic, Digest and NTLM Authentication

IIS Web Login Brute-Force Protection

Many websites use built-in IIS authentication to restrict access to admin panels, customer areas and other private content. Basic, Digest and Windows Authentication (including NTLM) can become targets for brute-force and dictionary attacks.

Freely available attack tools can try thousands of username and password combinations, consuming server resources and filling your logs with failed login attempts. A guessed password can expose private pages, sensitive information and administrative features available to the compromised account.

Failed IIS authentication can generate Event ID 4625 in the Windows Security log. The relevant fields identify the attempted account, failure reason and source IP address:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Event ID:      4625
Task Category: Logon
Keywords:      Audit Failure

Description:
An account failed to log on.

Account For Which Logon Failed:
  Account Name: admin

Failure Information:
  Failure Reason: Unknown user name or bad password.

Network Information:
  Source Network Address: 203.0.113.25

Illustrative event 4625 excerpt; account and IP address are examples.

RdpGuard detects repeated Windows logon failures and automatically blocks the source IP address when it reaches your configured limit, stopping further attempts from that address during the blocking period. Protection works with HTTPS because detection uses the Windows Security log, without decrypting web traffic.

You control the failed-login limit and blocking period, and can whitelist trusted IP addresses or receive notifications when an IP is blocked.

This protection covers IIS authentication failures recorded as Windows Security event 4625 with a client IP address. See the setup guide for requirements and configuration.

For 64-bit Windows and Windows Server. Supported Windows versions.

IIS Web Login Brute-Force Protection

See Also