由 dawei
在X次登录尝试
Windows服务器失败后是否可以禁用IP地址？不是特定的帐户,我知道该怎么做,而是整个机器.
我们在试图猜测用户名的暴力攻击时会受到相当大的打击,所以这真的有助于减轻服务器的负担.
您可以使用powershell和任务管理器执行此操作.它可能不是完美的解决方案,但它运行良好,我在两个月内有大约100个被阻止的IP地址.我编写了脚本,从EventLog指定的事件中选择(“审计失败”).如果来自任何IP地址的登录失败很多,则会将其添加到名为“BlockAttackers”的防火墙规则(手动创建)中,该规则会阻止指定IP地址的任何流量.
PS1脚本：
$DT = [DateTime]::Now.AddDays(-1) # check only last 24 hours
$l = Get-EventLog -LogName 'Security' -InstanceId 4625 -After $DT | Select-Object @{n='IpAddress';e={$_.ReplacementStrings[-2]} } # select Ip addresses that has audit failure
$g = $l | group-object -property IpAddress | where {$_.Count -gt 20} | Select -property Name # get ip adresses,that have more than 20 wrong logins
$fw = New-Object -ComObject hnetcfg.fwpolicy2 # get firewall object
$ar = $fw.rules | where {$_.name -eq 'BlockAttackers'} # get firewall rule named 'BlockAttackers' (must be created manually)
$arRemote = $ar.RemoteAddresses -split(',') #split the existing IPs into an array so we can easily search for existing IPs
$w = $g | where {$_.Name.Length -gt 1 -and !($arRemote -contains $_.Name + '/255.255.255.255') } # get ip addresses that are not already in firewal rule. Include the subnet mask which is automatically added to the firewall remote IP declaration.
$w| %{$ar.remoteaddresses += ',' + $_.Name} # add IPs to firewall rule
在调度程序中创建任务并将触发器设置为事件4625(包括终端服务的Windows登录).但你可以设置触发器来运行,例如每小时两次,以避免不必要的加载服务器.
并在触发器运行powershell脚本之后.您还必须设置更高的权限才能运行此脚本,否则它将因安全性异常而失败.
您还可以将此脚本绑定到其他安全事件.