Batch script to block IP in windows firewall

Question

I am creating a batch script to deal with the brute forcing through RDC on my server.

The way I plan on doing this is by making windows run my script when a failed RDC is logged in windows security log. I will add a whitelist to prevent trusted IP addresses from being blocked. It will also log how many times the IP has tried to login, and if it fails more than 5 times in a row, it will be blocked.

Problem is, I don't know how to pass the IP from the logged event to the batch script.

The Windows Server 2008 R2 event viewer has an ability to start a program when a specific event (With a event number) occurs. It has a box for arguments that can be passed onto the program that I can specify (which will be this batch script). However, It does not specify what arguments it can pass on (I want the IP to be passed onto the batch script... that is all).

Any help would be greatly appreciated.

Answer 1

I managed to fix it myself, using this . I adapted the one he had over to include $(IpAddress) and got it working after a bit of mucking around.