I have a couple SQL Server Express databases running on Windows Server 2008 R2 on a VPS.

A couple of websites access them (these are local connections, right?). Website connections use integrated security.

I also connect using Remote Desktop. SQL Server Express is accessible remotely through 1 port (same as Remote Desktop)

Problem: logs are showing failed login attempts every 5-10 seconds. They will be from 1 IP for a few minutes, then from another IP. They usually try user sa (I don't have one) or a variation. I have blocked several hundred of these using Windows Firewall, but they keep coming.

So - what else should I be doing? Is this something I should be worrying about?


2 Answers 2


It sounds like those failed logins are coming from the Internet.

You really shouldn't have a firewall port open to SQL Server directly from the Internet. That is just asking for trouble.

If the website and SQL Server are not on the same network, or are connected only via the Internet, you should look at providing a VPN connection between the two so that you don't provide an open port directly from the Internet to SQL Server.


Are you saying that your SQL Server is accessible remotely from any public IP address? If so then the simple answer is to not expose your server to the internet. This applies to your RDP connections too.

I would suggest investing in a VPN solution to access your servers remotely and disable any port forwarding rules you have to your SQL Server.

If you cannot do the above then you could limit the source IP address to a network of your own. This might reduce the number of failed login attempts but it is not advisable either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.