Windows Server 2008 Get list of ip in the Event Viewer that are Logon Failure

view full story

http://serverfault.com – I am having a lot of people relentlessly trying to get into my dedicated server via rdp. I have one ip that was hitting it for 3 hours straight about 5 times a second. Is there a way to get a list of the ips from the event viewer of those who have failed logons easily? I want to add these ips to my firewall to prevent further attempts. Thanks! (HowTos)