pbz's questions

About a week ago we moved the application from one server to another (from Windows Server 2008 to Windows Server 2008 R2, different DCs, but same company). There are 12 websites on this server, but they're all very low traffic sites (<200 hits per day).

Ever since we moved I noticed that the security log under Events -> Windows Logs -> Security is filled with packet drops. Most are trying to access port 25, 17, or some seemingly random port > 1024; it's rather spread out. Some come from reputable companies like Constant Contact (IP 208.75.123.132 for example), some from companies I personally didn't hear about, like Cogento 38.96.220.83, but that seem reputable. There are of course random IPs that don't point to anything in particular. All these ports are blocked and/or not used.

There are so many of these entries (about one or two per second on a guestimated average) that the log fills up in about a day and half. With the previous server, hosting the same sites, I could go back over two months.

Did I inherit (with the move) an IP that was used for who-knows-what and now all these services are connecting to me expecting the old services, or is there something else going on?

Any thoughts? Thanks!

EDIT: I should have mentioned this, the entries in the event logs are all "Event 5152 - The Windows Filtering Platform has blocked a packet."

EDIT2: Here's an article that touches on exactly the same problem I experienced. The important piece is to disable the auditing of dropped packets using auditpol, but also that it takes quite a bit of time until you get to see it work, unless you reboot immediately. I'm not sure why it works this way, but it definitely threw me off.

EDIT3: What the article leaves out, for Windows 7 / Server 2008 R2, you need to go to Local Security Policy -> Local Policies -> Security Options -> and enable "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings." By default it should be enabled, but in my case the "not defined" option didn't work, I had to manually enable it; more information here. A restart is required.

We have a new server with a Xeon 1270 processor. Looking at CPU-Z I see the Core Speed as 1596MHz, with a Multiplier of x16, and a Bus Speed of 99.8MHz.

I've been watching it for a while and sometimes noticed how the core speed jumps up to about 3GHz, which would match the advertised Clock Speed of 3.4GHz on Intel's website.

Is the core speed reported by CPU-Z and the clock speed on the Intel's website the same thing? Should I expect to have the core speed to be at 3.4GHz, rather than 1.5GHz?

The server doesn't have a lot of constant traffic, rather small bursts that don't seem to be enough to kick the CPU into a higher frequency. Am I correct in thinking that in my scenario, given that the CPU stays mostly constant at 1595MHz, we are getting much less than the benchmarked performance for this CPU?

Would you disable the Intel Turbo Boost? We have configured the power options to be high performance, but it doesn't seem to make a difference -- I read somewhere that the BIOS probably doesn't let Windows make the necessary changes.

Thank you,
Peter

If I RDP to a Windows Server 2008 box without proving any username or password information I get to see a list of the users on the computer. In Windows Server 2003 this list was not broadcasted. How can I make WS2008 not advertise what users are on the system? Thanks.

UPDATE: More specifically, this is Windows Server 2008 Web Edition 64 bit.

I'm looking at securing a web server (Windows Server 2008). A GRC port scan recommended that I close down port 135 (https://www.grc.com/port_135.htm). However, I've done this before with Windows Server 2003 and after doing this I wasn't able to RDP to the box.

Why is port 135 needed for RDP (port 3389) and since I don't have physical access to the box should port 135 be blocked (if so what about RDP)?

Thanks.

We currently have DDR II 667 RAM on the dedicated server. We're looking to a new server. One of the options only comes with DDR 400 (or DDR 400 registered). Is there a big difference between DDRII 667 and DDR 400? This is for an AMD Opteron 170 or Opteron 248.

Also, if I run CPUZ on the current server it reports the type of memory to be DDR (not DDRII) with a DRAM frequency of 200MHz, CAS Latency 3 clocks, RAS to CAS delay 4 clocks, RAS precharge 4 clocks, cycle time 8 clocks, banks cycle time 12 clocks, command rate 1T, DRAM Idle Timer 16 clocks. Does this match the DDRII 667 that we are supposed to have?

Thank you.