I have a couple SQL Server Express Databases which are accessible through a number of asp.net/IIS websites plus Remote Desktop (me only). The web sites use integrated security and I have one user account that I use. The problem is the logs show almost continuous attempts at failed logins. These occur every 5-10 seconds or so, from one IP for about 5 minutes, then the IP changes. The user name being attempted is usually 'sa' or some variation (I don't have an 'sa' user). I have blocked several hundred of these IPs using Windows Firewall, but they just keep coming. This results in huge log files and I guess a lot of bandwidth being used. So my question: Do I have enough security in place that I don't have to really worry about this - or is there something more I should be


2 Answers 2


If possible, you should change your security approach to be denied by default, allowed by permission.

Block access from all unknown IP's. Allow access from trusted IP's.


Absolutely yes.

The failed logon attempts mean that someone/something at least has access to the IP/Port and your server might be facing the internet.

It's not the failed logon attempts that you should worry about as much as the successful ones you might not notice.

You are also exposing yourself to DoS attacks and increasing the attack surface unnecessarily.

Get your SQL Server behind a firewall right now. I thought we learned that after Slammer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.