RdpGuard allows you to effectively stop
password guessing brute-force attacks on your MS-SQL server.
It monitors system event logs (Application) for MS-SQL failed login attempts (events with IDs 18456, 17832, 17836) and blocks
IP addresses if the number of failed login attempts reaches a set limit.
These events are written by MS-SQL server if the corresponding option is turned on in MS-SQL Management Studio.
To enable logging for failed MS-SQL login attempts
1. Start Microsoft SQL Server Management Studio
2. Right-click on your server and choose Properties
Right-click on your server and choose Properties
The Server Properties dialog will open:
MS-SQL Server Properties dialog
3. Navigate to Security and check the Login auditing group.
4. Set Login auditing to Failed logins only or Both failed and successful logins.
5. Click OK.
To Enable MS-SQL Server Protection
Start RdpGuard Dashboard and click on the link next to MS-SQL
MS-SQL Protection Link in RdpGuard Dashboard
The MS-SQL Settings dialog will open:
MS-SQL Protection Settings Dialog
Turn on Enable MS-SQL protection
Events to monitor
Event ID 18456 - in most cases, these events indicate a brute-force attack on MS-SQL Server.
It is recommended to keep it enabled.
Event ID 17832 - this event may also be a part of an attack on MS-SQL server.
You may also enable it if you receive multiple 17832 events with a message
like "The login packet used to open the connection is structurally invalid;
the connection has been closed. Please contact the vendor of the client library."
Event ID 17836 - this event may also be a part of an attack on MS-SQL server. You may also enable it if you receive
multiple 17836 events with the message like "Length specified in network packet payload did not match number of bytes read;
the connection has been closed. Please contact the vendor of the client library"
Exclusions for Event ID 18456
In some cases, you may want to exclude 18456 Events from processing based on the Reason field in event details.
To exclude 18456 Events based on the Reason field:
1. Click the Exclusions link next to the Event ID 18456 check-box:
Click the Exclusions link
The MS-SQL Exclusions dialog will open:
MS-SQL Exclusions dialog
2. Enter exclusion patterns for the Reason field. One exclusion pattern per line.
Event ID 18456 will be skipped from processing if the Reason field contains any of the exclusion patterns.
"This sotware is really great. It's a relief. Because my server is constantly under attack. Thanks RdpGuard"
- Joaquim De Sousa Marques
"Nice product. I used to implement something similiar in a low-tech and cumbersome manner via a script called
TSBlock (not mine). This makes it much easier and is well worth the pricetag for SMB's."
- J. Johnson
"Absolutely amazed at your product. We are a church in the North Dallas area,
and I discovered this morning multiple failed logon attempts via our Remote Access Server.
A friend suggested your product, so I immediately downloaded the trial.
It had a list of about five blocked IP addresses in minutes, and that was enough to
lead me to push the BUY button. Over the past 10-15 minutes the list is now about thirty with at least a
third being international attempts to break into our system.
Thanks for a great product. You may have just saved us much grief."
- John Hallford
"Love the software. RDP on our Windows servers is just ridiculous.
We would block it in the router but we have lots of old-time customers that would have issues."
- Scott Hirsch
"Love the software! Makes it easier than tailoring VB Scripts!!"
- Nick Brennan
"It's a great product - really stopping those RDP attackers :-)"
- Dave, UK
"First of all: Your application is very (!!!) useful and I like it very much securing my 2012 R2 server.
RdpGuard is the best solution, I found on the market and after 10 minutes of testing it I ordered the fully-featured version. :-)"
- Carsten Baltes
