Announcement

Collapse
No announcement yet.

Event Id 56

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Event Id 56

    does anybody know why i cannot post a new topic on here ? it has been a while. what i am missing ? TIA

  • #2
    Lately, i've seen many event id 56 on our remote server.
    it says 'The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.
    Client IP: 82.202.249.19.'
    Most of the client IPs belong to our users. Many of them are from countries like Russian and Germany.
    I look up for '82.202.249.19' and it is from Russia. I have enabled port forwarding on our remote server so it is no longer 3389.

    i wonder if this is just port scanning that h a c k e r s do or our server has been compromised ? any help is appreciated. TIA
    Click image for larger version

Name:	snapshot.png
Views:	5
Size:	26.7 KB
ID:	516629

    Comment


    • #3
      Something to do with the picture, I think. Post approved, other topics deleted
      Tom Jones
      MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
      PhD, MSc, FIAP, MIITT
      IT Trainer / Consultant
      Ossian Ltd
      Scotland

      ** Remember to give credit where credit is due and leave reputation points where appropriate **

      Comment


      • #4
        Thanks Ossian. any chance you can change my topic to 'Event Id 56' or delete the 'post a new topic' post ? Thanks.
        Last edited by spn; 1st April 2018, 21:37.

        Comment


        • #5
          First result: https://social.technet.microsoft.com...um=winserverTS
          Lots of trouble-shooting suggestions in that thread.
          A recent poll suggests that 6 out of 7 dwarfs are not happy

          Comment


          • #6
            Thanks Blood.

            Comment

            Working...
            X