win2008系统日志不断出现审核失败的解决方法
<p><strong>【现象】</strong></p><p>今天查看windows日志，在 -安全- 发现不断有消息刷出，显示 -审核失败- 事件ID为4624 的记录 每分钟大概刷新8条消息（如图）</p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300013.jpg" /></p>
<p>【<strong>个人判断</strong>】</p>
<p>可能存在不断的尝试性登入，试图在短时间内不断的以多个帐密测试破解登入帐密，攻入服务器远程控制。</p>
<p>【<strong>日志记录详细日志</strong>】</p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300014.png" /> <img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300015.png" /></p>
<p>【<strong>处理</strong><strong>/</strong><strong>解决方案</strong>】</p>
<p>1.使用防火墙限制指定IP不能访问</p>
<p>2.在日志》网络信息》源网络地址: 58.211.7.237 查到尝试登录IP</p>
<p>3.使用防火墙限制此IP</p>
<p>【<strong>具体步骤</strong>】</p>
<p><strong>1. </strong>打开服务管理器》高级安全Windows防火墙》如站规则</p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300016.jpg" /></p>
<p><strong>2. </strong>右键，新建入站规则</p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300017.jpg" /></p>
<p><strong>3.</strong>自定义规则</p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300018.jpg" /></p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300019.jpg" /><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300020.jpg" /><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300021.jpg" /><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300022.jpg" /></p>
<p><img alt="" src="https://img.jbzj.com/file_images/article/201403/2014031209300023.jpg" /></p>
<p><strong>问题解决！</strong></p>
頁:
[1]