Security

Ask something
Discussion Locked

Attempted Administrator login

0 helpful
2 replies

by louisn

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've enabled auditing and noticed a failed attempt to log onto our mail server (the BDC). Nothing unusual, except that this was after hours and it was an attempt to log on as Administrator ... The Event Log had our domain name and our mail server name in the details.

My question: does this mean the attempt originated from our domain/this computer, or merely that it was the target? And if it means it was the target, the attempt was from outside, right?

2 replies

by joseph moore

Ok, here is a Event ID 529 from my Security log in Event Viewer:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 11/13/2002
Time: 9:39:26 PM
User: NT AUTHORITY\SYSTEM
Computer: LAPTOP
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: JOE
Domain: MYDOMAIN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: ATTACKERMACHINE

Ok, the Workstation Name field is the important one here. It is the machine listed there, in this case "ATTACKERMACHINE" that the failed logon attempt originated from! So, all I would need to do is figure out what machine is ATTACKERMACHINE and then I could go from there.
Now, that is all well and good if the machine name listed is on my LAN. If it is not, then I do not have many options left. Even Internet-based machines would only list there NetBIOS name, not an IP address or anything else useful like that.

So, check your logs and see what machine name was listed in Workstation Name. If it recognizable,then go at it. IF you DON'T recognize it, then it was probably an external-based attack, and you need to check your firewall settings (if you even run a firewall, and I hope you do!!)

hope this helps

by louisn

Hi Joseph

Thanks for that.

Here's an copy of that event log entry (domain name and workstation name changed):

Logon Failure:
Reason: The user has not be granted the requested
logon type at this machine
User Name: Administrator
Domain: Our_domain
Logon Type: 4
Logon Process: Advapi
Authentication Package:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: Mail_server_name

So does this mean the attempt was actually from the mail server itself? I somehow doubt that, as it's in a locked server room in a locked rack.

Under what other circumstances would one get a reference to the server as the computer name? Maybe with remote control software? Or what about OWA? If definitely wasn't via RAS - that's what I checked for first. Or can the computer name be spoofed?

This discussion is closed to new replies.