Strange entries in Microsoft-TerminalServices-RemoteConnectionManager%4Operational.evtx

Question

Hi there, I am currently analyzing a Windows Server 2008, and am digging in the EVTX files. I see numeros entries of EventID 1149 ("User authentication succeeded") done by foreign IP addresses, with user names which clearly are unknown to the system. (looks
like brute-force with a dictionary file to me...) My question is simple : why do I see successful authentication on users who do not exist ? (example : john, test1, user1, and many others) I see absolutely no fail in any of those authentication, is there something
I don't get ? Thank you for your time and help, Best regards.

Answer 1

Hi,
Event ID 1149 — Remote Desktop Session Host Listener Availability
The listener component runs on the RD Session Host server and is responsible for listening for and accepting new Remote Desktop Protocol (RDP) client connections,
thereby allowing users to establish new remote sessions on the RD Session Host server. There is a listener for each Remote Desktop Services connection that exists on the RD Session Host server. Connections can be created and configured by using the Remote
Desktop Session Host Configuration tool.
Have you published internal terminal server services to the external network ( internet ) ? if so, this may due to external RDP scan or access, you can change your
firewall settings to see if the same issue still exists. For example, if you are using Microsoft TMG or ISA, you can change policy like below.
Allow Protocol RDP
From: Everyone
To: Local Host/Terminal server
Changing that rule to only Allow From VPN Clients & Internal network clients.
Hope this helps.
Technology changes life……