RD Web Access Brute-Force Protection for Windows Server

Remote Desktop Web Access (RD Web Access), formerly Terminal Services Web Access (TS Web Access), provides a web portal for RemoteApp and Desktop Connection. Users can access their published applications and remote desktops through this portal.

If you have RD Web Access enabled on your server, you may notice repeated failed logon events in the Windows Security log:

Date and time        Event ID  Task   Keywords
4/3/2017 11:55:01    4625      Logon  Audit Failure
4/3/2017 11:54:59    4625      Logon  Audit Failure
4/3/2017 11:52:45    4625      Logon  Audit Failure
4/3/2017 11:51:17    4625      Logon  Audit Failure
4/3/2017 11:43:04    4625      Logon  Audit Failure
4/3/2017 11:43:00    4625      Logon  Audit Failure

Windows Security log: repeated failed logons (event ID 4625).

A failed RD Web Access logon event can include details like these:

An account failed to log on.

Subject:
  Security ID:         IIS APPPOOL\RDWeb
  Account Name:        RDWeb
  Account Domain:      IIS APPPOOL
  Logon ID:            0x3091c6d6

Logon Type:            3

Account For Which Logon Failed:
  Security ID:         NULL SID
  Account Name:        Administrator
  Account Domain:

Failure Information:
  Failure Reason:      Unknown user name or bad password.
  Status:              0xc000006d
  Sub Status:          0xc0000064

Process Information:
  Caller Process ID:   0x143c
  Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe

Example event details showing the RDWeb application pool and IIS worker process.

Your IIS logs may also contain repeated requests to the RD Web Access login page:

Time      Client IP      Method URI                           Status
11:02:26  176.62.100.189 POST   /RDWeb/Pages/en-US/login.aspx 200
11:02:26  176.62.100.189 POST   /RDWeb/Pages/en-US/login.aspx 200
11:02:26  176.62.100.189 POST   /RDWeb/Pages/en-US/login.aspx 200
11:02:27  176.62.100.189 POST   /RDWeb/Pages/en-US/login.aspx 200
11:02:27  176.62.100.189 POST   /RDWeb/Pages/en-US/login.aspx 200
11:02:27  176.62.100.189 POST   /RDWeb/Pages/en-US/login.aspx 200

Selected IIS log fields: repeated POST requests to the RD Web Access login page.

Repeated requests to the RD Web Access login page, especially alongside failed logon events, can indicate a password-guessing attack. An HTTP 200 response alone does not tell you whether the login succeeded or failed.

RdpGuard helps protect your RD Web Access server from brute-force attacks. It monitors IIS logs and Windows Security events to detect suspicious login attempts and automatically blocks attacking IP addresses when the configured limit is reached.

For 64-bit Windows and Windows Server. Supported Windows versions.

RD Web Access Brute-Force Protection

See Also