Extra Systems Ban Software (ESBANS)

ES-RDP

File set_log_size.bat

The set_log_size.bat file is designed to change the size of the Windows log file "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational", which records RDP port events analyzed by our ES-RDP system to detect malicious activity on the server. Increasing the log size is necessary because the default capacity (about 1 megabyte) is too small to ensure effective attack detection. The set_log_size.bat script provided below sets the log size to 48 megabytes. This value is customizable, but we do not recommend setting it below 16 megabytes.

@set /a "MBYTES=48"
@set /a "BYTES=MBYTES * 1024 * 1024"
@<nul set /p ="Old" & wevtutil gl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational" | findstr "maxSize"
@wevtutil sl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational" /ms:%BYTES%
@<nul set /p ="New" & wevtutil gl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational" | findstr "maxSize"
@echo.
@pause

The content of this page is also available in Russian.