windows – 基于X次登录尝试失败的禁止IP地址？

在X次登录尝试 Windows服务器失败后是否可以禁用IP地址？不是特定的帐户,我知道该怎么做,而是整个机器.

我们在试图猜测用户名的暴力攻击时会受到相当大的打击,所以这真的有助于减轻服务器的负担.

PS1脚本：

$DT = [DateTime]::Now.AddDays(-1) # check only last 24 hours

$l = Get-EventLog -LogName 'Security' -InstanceId 4625 -After $DT | Select-Object @{n='IpAddress';e={$_.ReplacementStrings[-2]} } # select Ip addresses that has audit failure 
$g = $l | group-object -property IpAddress  | where {$_.Count -gt 20} | Select -property Name # get ip adresses,that have more than 20 wrong logins

$fw = New-Object -ComObject hnetcfg.fwpolicy2 # get firewall object

$ar = $fw.rules | where {$_.name -eq 'BlockAttackers'} # get firewall rule named 'BlockAttackers' (must be created manually)

$arRemote = $ar.RemoteAddresses -split(',') #split the existing IPs into an array so we can easily search for existing IPs

$w = $g | where {$_.Name.Length -gt 1 -and  !($arRemote -contains $_.Name + '/255.255.255.255') } # get ip addresses that are not already in firewal rule. Include the subnet mask which is automatically added to the firewall remote IP declaration.

$w| %{$ar.remoteaddresses += ',' + $_.Name} # add IPs to firewall rule

在调度程序中创建任务并将触发器设置为事件4625(包括终端服务的Windows登录).但你可以设置触发器来运行,例如每小时两次,以避免不必要的加载服务器.

并在触发器运行powershell脚本之后.您还必须设置更高的权限才能运行此脚本,否则它将因安全性异常而失败.

您还可以将此脚本绑定到其他安全事件.

（编辑：达州站长网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!