Today at 11:10am EST we received about 110 attacks from different user names like admin, ftp, mail, sales and so on. I've pasted the event id properties below. We do have port 25 and 443 open and I'm guessing it could be an attack on Remote Web Workplace. Any ideas on what this is and how I can stop these attacks? Any help is greatly appreciated. Thanks
Logon Failure:
Reason: Unknown user name or bad password
User Name: sales
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SERVERNAME
Caller User Name: SERVERNAME$
Caller Domain: DOMAINNAME
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2156
Transited Services: -
Source Network Address: -
Source Port: -
Logon Failure:
Reason: Unknown user name or bad password
User Name: sales
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SERVERNAME
Caller User Name: SERVERNAME$
Caller Domain: DOMAINNAME
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 2156
Transited Services: -
Source Network Address: -
Source Port: -