3 ms·

My old ts_block[0] project does something similar to yours, albeit for RDP only and with much less sophisticated customization. I opted to go with a WMI Event

My old ts_block[0] project does something similar to yours, albeit for RDP only and with much less sophisticated customization. I opted to go with a WMI Event Sink rather than polling the Event Log. I've never done a benchmark to see which architecture would use less CPU, but I can say the WMI event sink causes nearly instantaneous reaction. As an aside: I'd love to hear if somebody tries ts_block on Windows Server 2022. It works fine on 2012 R2 thru 2019 but I've never tried it on 2022. [0] https://github.com/EvanAnderson/ts_block https://github.com/EvanAnderson/ts_block

frogger8 4y ago
Not my project. I was also going to post yours but decided not to due to questions in issues about support for newer versions of windows. Something about IP address missing from event?
- EvanAnderson 4y ago
  I've long-neglected ts_block and probably should update the documentation, if nothing else. Windows Server 2012 R2 removed the IP address from the Event Log entry for failed RDP logons (to be fair, it's really that the just didn't include it in failed RDP logons when the TLS security layer is used-- reverting to the old RDP security layer in Windows Server 2012 R2 restores the IP address). Without doing something dodgy like trying to correlate closed TCP connections to Event Log entries there's no simple way to ascribe IP addresses to failed RDP logons on that version of Windows. In Windows Server 2016 and 2019 Microsoft put the IP address back into the Event Log entry, restoring ts_block's functionality.
  - greatquux 4y ago
    Yep confirmed works great on 2016 and 2019.
greatquux 4y ago
Thanks for this dude! I have a forked copy with a few different things and it works great. We catch so many IPs and I get a good feeling about slowing down these guys. I do still have to try on 2022 but I don’t see why it wouldn’t work. https://github.com/greatquux/ts_block https://github.com/greatquux/ts_block
- EvanAnderson 4y ago
  Hey greatquux-- nice to see you here! If I ever bother to work on ts_block again I'm definitely going to implement all the features you added. (I'm aware you've already written the code but, for me, half the fun is writing the code. >smile<)

frogger8 4y ago

Not my project. I was also going to post yours but decided not to due to questions in issues about support for newer versions of windows. Something about IP address missing from event?

EvanAnderson 4y ago
I've long-neglected ts_block and probably should update the documentation, if nothing else. Windows Server 2012 R2 removed the IP address from the Event Log entry for failed RDP logons (to be fair, it's really that the just didn't include it in failed RDP logons when the TLS security layer is used-- reverting to the old RDP security layer in Windows Server 2012 R2 restores the IP address). Without doing something dodgy like trying to correlate closed TCP connections to Event Log entries there's no simple way to ascribe IP addresses to failed RDP logons on that version of Windows. In Windows Server 2016 and 2019 Microsoft put the IP address back into the Event Log entry, restoring ts_block's functionality.
- greatquux 4y ago
  Yep confirmed works great on 2016 and 2019.

greatquux 4y ago

Thanks for this dude! I have a forked copy with a few different things and it works great. We catch so many IPs and I get a good feeling about slowing down these guys. I do still have to try on 2022 but I don’t see why it wouldn’t work. https://github.com/greatquux/ts_block https://github.com/greatquux/ts_block

EvanAnderson 4y ago
Hey greatquux-- nice to see you here! If I ever bother to work on ts_block again I'm definitely going to implement all the features you added. (I'm aware you've already written the code but, for me, half the fun is writing the code. >smile<)