6

Windows Server 2008 Get list of ip in the Event Viewer that are Logon Failure

view full story
linux-howto

http://serverfault.com – I am having a lot of people relentlessly trying to get into my dedicated server via rdp. I have one ip that was hitting it for 3 hours straight about 5 times a second. Is there a way to get a list of the ips from the event viewer of those who have failed logons easily? I want to add these ips to my firewall to prevent further attempts. Thanks! (HowTos)

xskl's picture
Submitted by xskl on 07/06/2012 – Made popular on 07/06/2012

Stories similar to Windows Server 2008 Get list of ip in the Event Viewer that are Logon Failure

Domain Controller OS - Window Server 2008 R2

Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note the Red Rectangle Colour Box.

Yesterday i just finished installing a file server running Windows 2008 to our company.

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs.

Whenever I move an event log it seems to become corrupted and I get the message "Unable to complete the operation on SysEvent.evt.

In the last 2 days my dedicated server (Windows Web Server 2008 R2) has crashed twice and restarted.

I've looked in the Event Logs and there's nothing logged leading up to it.I'm very technical, but not a trained server administrator.

I have a dedicated server since my site is active enough to require one.

I am pretty new to Windows Server 2008. On two separate events it shut itself down without any good reason. I would like to diagnose this, but don't know where to start. Where and what should I look for in the Event Viewer, and what else can I do to fix this problem? Also, is there an auto shutdown and startup scheduler in Server 2008?

Event Viewer VB scripts 45 weeks 5 days ago

I am sure it has been asked million times, but I can't seem to find an appropriate answer for my simple need. I am looking for a VB script that would pull event viewer logs into one location, either emailed to me or place on let's say my computer.

Thank you for your help!

On Windows Server 2008 when trying to open either Event Viewer or Windows Firewall settings, I'm getting the following error:

MMC could not create the snap-in. The snap-in might not have been installed correctly.

Name: Windows Firewall with Advanced Security

CLSID: FX: {b05566ac-fe9c-4368-be02-7a4cbb7cbe11}

I was just going through the logs of one of my servers and I noticed there are a ton of failed logon attempts for username Administrator, owner and Admin. I assume that these are bots since there is almost one every second, but my question is what do you normally do about this?

I seem to be getting a lot of these entries in the Security event viewer. Around 8-12 every hour. I am wondering if a) I should be worried about it?