terminal server under attack?

[Guest Martin Paulik]

Hi all,

 

from time to time we have following in event log:

 

"The terminal server received large number of incomplete connections.

The system may be under attack."

 

terminal server stops to respond to rdp, only way is to reboot.

 

does anyone know how to disable this test? or any other solution?

 

thank you

 

Martin Paulik

[Guest sen_ismail@web.de]

Re: terminal server under attack?

 

On Oct 8, 11:36 pm, Martin Paulik <martin.pau...@nospam-datart.sk>

wrote:

> Hi all,

>

> from time to time we have following in event log:

>

> "The terminal server received large number of incomplete connections.

> The system may be under attack."

>

> terminal server stops to respond to rdp, only way is to reboot.

>

> does anyone know how to disable this test? or any other solution?

>

> thank you

>

> Martin Paulik

 

Hello,

 

1. Start Registry Editor.

2. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer

3. On the Edit menu, click Add Value, and then add the following

registry value if

the registry value does not exist.

Value name Data type MaxOutstandingConnect DWORD

 

Note: The registry value should be set to the appropriate threshold to

achieve the

required connection detection. For example, if 50 connections are

required, set the

value to 32 in hexadecimal format.

 

 

cheers

Ismail