Software Title: Remote Desktop IP Monitor & Blocker
Download Link: http://www.tweaking.com/content/page/remote_desktop_ip_monitor_blocker.html
Contact Them: http://www.tweaking.com/forums/
License: Freeware Tools, Not sure if they will be in the future so grab them now!
Remote Desktop IP Monitor & Blocker is a free tool to monitor any IP that tries to connect to the remote desktop.
I made this program after seeing brute force attacks on a customers server who had remote desktop enabled and open to the internet. The attacks were trying to brute force the password for the administrator account.
The Windows Event Viewer was not showing which IP address the connections were coming from. They were also coming from multiple locations and hitting at random times during the day and night. So tracking them down with the built in Windows tools was going nowhere.
So I decided to make a tool that will monitor and log any IP that hits the remote desktop and to be able to block those IP’s.
This free program will monitor the remote desktop port using the Windows netstat API and keep them in a log for later viewing. The program has a built in block IP tool to easily block any IP address. It does this by using the built in Windows IP Security Policy (IPSec). It can only block IP’s, but it can not unblock them. To unblock them I have included a guide here: How to remove IP’s from the Windows IP Security (IPSec) Added by the Tweaking.com – Block IP Tool
Even though this tool was built for watching the remote desktop port you can use it to watch any single port on the system. So if you have another kind of server running and the port open to the internet you can now log any IP that hits it.