Dashboard
Login attempts
| IP address | Location | Attempts | Username | First seen | Last seen | Status | |
|---|---|---|---|---|---|---|---|
| No data — start the monitor or wait for attempts. | |||||||
Blocked IPs
| IP address | Location | Type | Attempts | Blocked at | Expires | |
|---|---|---|---|---|---|---|
| No blocked IPs. | ||||||
Threat intel
Security health
Logs
Zopi Guard licence
Zopi Guard protects this server while it has a valid licence. New installs start with a 30-day free trial. If a licence lapses, protection carries on for 14 days, and you'll be warned for the last 7. Blocked IPs always stay blocked.
Zopi Guard Setup.exe /S /LICENCE=ZG-…Windows Service
The service starts at boot and protects the server before anyone signs in. It runs as SYSTEM and shares its database with this app.
Zopi Guard Setup x.x.x.exe) to register the service — it handles everything automatically.
Thresholds and trust
When an IP gets blocked, for how long, and which IPs get the benefit of the doubt.
More than Remote Desktop
Zopi Guard watches these for password guessing too, with the same limits, allowed IPs and blocking as Remote Desktop. A blocked IP is shut out of the whole server, not just the service it attacked.
Good to know
- SQL Server must log failed logins (Server properties → Security → Login auditing → Failed logins only — the default).
- IIS / Exchange: covers sign-ins using Windows or Basic authentication — Exchange ActiveSync, EWS and Autodiscover, RD Web. Custom web login forms aren't visible in IIS logs. IIS writes its logs about once a minute, so blocks can lag by that much.
- If web traffic arrives through a load balancer or proxy, add an X-Forwarded-For field to IIS logging so Guard sees the real visitor. Private addresses are never blocked for web or FTP.
- OpenSSH is Windows' built-in SSH server; FTP is the IIS FTP service.
Whitelist
These IPs are never blocked, whatever they do. One IP or CIDR range per line, e.g. 192.168.1.0/24.
Spot an attacker who gets in
Blocking stops attackers who fail. These alerts catch the one that succeeds — by email and in the event log.
Accounts under attack
Only allow RDP from
If your people only ever connect from a few countries, allow just those. Everyone else is refused at the firewall before they can try a password. Your allowed IPs, your own network and anyone connected right now always stay open.
Block countries
Permanently blocks any IP from a selected country on its first attempt. Use this instead of the allow list if you have users in many places. Allowed IPs are always exempt.
Zopi threat network
Every Zopi Guard reports the attackers it blocks. An IP seen attacking servers at two or more organisations joins a shared blocklist, so an attacker caught on one server is stopped on all of them. IPs on your allowed list, and anyone who has logged in here, are never blocked by the network.
Tor and VPN lists
Block known anonymising networks outright. Lists are cached on this server and refreshed every 24 hours.
Email alerts
Monthly security report
On the 1st of every month, Zopi Guard emails a report on the month before: attacks, blocks, where they came from, any break-in alerts, and this server's Cyber Essentials readiness (attached in full). It uses the email server set up under Email alerts.
Data retention
Old attempt records are pruned automatically every hour. Permanent blocks are never deleted.
Automatic updates
The Zopi Guard service checks updates.zopi.uk every few hours. Updates are signed by Zopi and checked before they install, and they never install during an attack.