terminal server under attack?

  • Thread starter Thread starter Martin Paulik
  • Start date Start date
M

Martin Paulik

Guest
Hi all,

from time to time we have following in event log:

"The terminal server received large number of incomplete connections.
The system may be under attack."

terminal server stops to respond to rdp, only way is to reboot.

does anyone know how to disable this test? or any other solution?

thank you

Martin Paulik
 
Re: terminal server under attack?

On Oct 8, 11:36 pm, Martin Paulik <martin.pau...@nospam-datart.sk>
wrote:
> Hi all,
>
> from time to time we have following in event log:
>
> "The terminal server received large number of incomplete connections.
> The system may be under attack."
>
> terminal server stops to respond to rdp, only way is to reboot.
>
> does anyone know how to disable this test? or any other solution?
>
> thank you
>
> Martin Paulik

Hello,

1. Start Registry Editor.
2. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer
3. On the Edit menu, click Add Value, and then add the following
registry value if
the registry value does not exist.
Value name Data type MaxOutstandingConnect DWORD

Note: The registry value should be set to the appropriate threshold to
achieve the
required connection detection. For example, if 50 connections are
required, set the
value to 32 in hexadecimal format.


cheers
Ismail
 
Back
Top