我的 Windows 2008 R2 服务器收到了大量的登录尝试。
我猜有人在进行蛮力攻击。
有趣的是，我们的 MySQL 配置文件昨晚被删除了，所以他们一定是通过某种方式进入的。但与此同时，我的事件日志中充满了这些消息：
A Windows Filtering Platform filter has been changed.
Subject:
Security ID: LOCAL SERVICE
Account Name: NT AUTHORITY\LOCAL SERVICE
Process Information:
Process ID: 1184
Provider Information:
ID: {decc16ca-3f33-4346-be1e-8fb4ae0f3d62}
Name: Microsoft Corporation
Change Information:
Change Type: Delete
Filter Information:
ID: {3798315c-c633-46ee-8421-89dab23673e9}
Name: File and Printer Sharing (Spooler Service - RPC-EPMAP)
Type: Not persistent
Run-Time ID: 3444308
Layer Information:
ID: {e1cd9fe7-f4b5-4273-96c0-592e487b8650}
Name: ALE Receive/Accept v4 Layer
Run-Time ID: 44
Callout Information:
ID: {00000000-0000-0000-0000-000000000000}
Name: …