Windows Forum

Ask something
Discussion Locked

All domain accounts lock - regular basis

0 helpful
10 replies

by p.erickson

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I inherited a small 30 workstation network that has 4 NT servers running service pack 6a. On a regular daily basis all of the domain accounts lock in alphabetical order. There is no specific time or event to tie it to. Sometimes it happens in teh morning, sometimes overnight sometimes in the afternoon. It looks as though the BDC is processing the logins. The logins come from fictional workstation/domain names it seems. What could it be? what should I do?

10 replies

by dotcomma

Strange indeed!
I guess you already checked for viruses/worms/trojans, which would be my first idea, since it happens in alphabetical order and from fictional names.

Do you have internet connectivity? Is the firewall setup correct? Or are there individual users with modems connecting out?
When the netbios ports aren't closed to the internet, someone from the outside might try to connect to your domain.

Monika

by don christner

Sounds like someone is using a brute force attack to try to login to your network. You must have autolockout after a certain number of attempts. You need to find the IP of who is attempting to login and report the activity to their ISP immediately.

Don

by p.erickson

How Do I track the attack and locate where it is coming from? Are there any programs out there to see which IP this is coming from? I would think it would be especially hard seeing as the workstation name changes frequently.

by cg it

look at snort http://www.snort.org/

now you need to determine if this is a WAN attack or LAN attack. Snort will give you so much information if can be overwhelming, especially if you have it on a system before your firewall. If you put snort after your firewall and before your network, you'll be able to find out just about everything on what's coming in and going out. If your intrusion is NOT WAN based, then you might consider some measures to lockdown workstations. [some of which are sure to get the users to revolt and take up arms]

by cg it

LAN based attacks should be fairly easy to find out where they are coming from. someone locally logs on and runs their brute force crack program. I doubt it but hey, it's been known to happen. Lock down workstations as tight as you can without user revolt [deny CD, Floppy, shutdown access unless locally logged on. Deny log on locally to everyone except the admin account. selectively deny internet access by group and see if it stops. then allow it and see if it starts up again.

This discussion is closed to new replies.