Trying to track down Windows 2003 log file for use with ossec in catching brute force Window RDP events

[Peter M. Abraham]

Greetings:

On a Windows 2003 server, does anyone know where I can find out the
log file (if it exists) which would store the remote IP address of the
machine that tried to break in per the below Windows Event log?:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 8/10/2008
Time: 10:28:44 PM
User: NT AUTHORITY\SYSTEM
Computer: WIN2
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: WIN2
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: WIN2
Caller User Name: WIN2$
Caller Domain: DNI-HSPHERE
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1596
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Thank you.

[Derek J. Morris]

I would like to know this too. Have similar issue.

[Who Me]

My advice would be to see if you can duplicate the errors and then do some event correlation between your event logs and IIS logs.  I tried (quickly) to duplicate it in my environment to no avail.  Sorry. --- On Tue, 8/12/08, Derek J. Morris <dmo...@digitalmorris.com> wrote:

[Peter M. Abraham]

Greetings:

Does anyone know if there is a log file, and its location, for RDP in
terms of storing the user id and IP address of login attempts?

Thank you.

[Roch]

Have a look in \system32\Tssdis.log, You need to enable event auditing
in the GPO and auditing in Terminal Services configuration. Cant check
myself so not sure if this is exactly what you are looking for.

2008/8/13 Peter M. Abraham <peter....@dynamicnet.net>:

[Michael Starks]

Hello Peter,

These are stored in the Windows Event Log, as 682 and 683 for session
reconnected and disconnected, respectively. A 528 is logged for the
initial local logon.

HTH

[Michael Starks]

Peter M. Abraham wrote:
> Greetings:
>
> On a Windows 2003 server, does anyone know where I can find out the
> log file (if it exists) which would store the remote IP address of the
> machine that tried to break in per the below Windows Event log?:

Do you know what the reconnaissance, if any, looked like? Maybe you can
get the IP from firewall logs or some other service which logs the
source IP. I think you may need to do some manual correlation.

[Peter M. Abraham]

Greetings Michael:

Is the IP address of the party trying to connect via RDP stored
anywhere?

thank you.