Hi Tom;
Thanks for the reply.
I have a good anti-virus program on the TS and nothing is amiss.
I've attached 3 images showing IP addresses that are either SYN_RCVD or ESTABLISHED. These IP address are from GB, the Netherlands, Bulgaria, Russia, etc.
I know that SYN_RCVD tells me that someone is "knocking on the door" so to speak, but do not understand why sometimes they become ESTABLISHED as I have blocked the IP addresses.
I *do not* see any failed login attempts in Windows Event Viewer.
Trying to figure out what is actually happening and if they have somehow gained access to my TS and are using it without logging in.