Recently we’ve noticed that some of our servers were getting around 2000 login attempts every day. All of them using administrator account, only with a wrong password.
Looking around, we’ve found that the RPC of one of our servers (running Windows Server 2012 r2) is trying these logins around automatically. We tried to block the RPC service on the firewall, but no success.
Any options on the RPCSS about the logon accounts are greyed, so the question is:
What, exactly, is happening? How can I stop RPCSS from doing this?
It looks like an attack, but since it doesn’t change usernames, only attempts to use one account, it really looks like it’s the service doing it.
