Windows Server

Any Windows Server role that accepts sign-ins over the internet — Remote Desktop, a mail server, a web application, a database — is reachable by automated tools that continuously try sign-in combinations against exposed endpoints. This isn’t specific to any one customer or configuration; it’s a routine consequence of being reachable at all.

How Syspeace responds

Syspeace Service runs on each protected server and follows the Windows Security event log for repeated failed sign-in attempts. When activity matches a configured rule, Syspeace blocks the offending IP address:

• Syspeace v4 blocks directly through the Windows Filtering Platform, so enforcement keeps working even if Windows Firewall is disabled or managed by other software.
• Syspeace v3 blocks through Windows Firewall or IP Security Policy.

In Syspeace v4, every protected server reports to Syspeace Console, so administrators can review activity and blocks across their servers from one place rather than checking each server individually.

Where Syspeace fits

Syspeace is one layer in a Windows Server security strategy, not a replacement for the rest of it. It doesn’t provide multi-factor authentication, patch management, network segmentation, account lockout policy, endpoint protection, or firewall policy — those remain necessary regardless of whether Syspeace is installed. What Syspeace adds is a response to the specific pattern of repeated failed sign-in attempts against a server’s own authentication surface.

Supported Windows Server versions

Syspeace v4 requires Windows Server 2008 R2 or later. Syspeace v3 supports Windows Server 2003 and later. See the version comparison for the full picture, and downloads to get started.