Windows Forum

Ask something
Discussion Locked

Security on server 2000

0 helpful
2 replies

by ratface

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello, I am a very new server admin.
I have a windows 2000 server. I looked at the event logs and saw that someone was trying tocrack the system. There were hundreds and hundreds of unsuccessful logon attempts during last night.
Each attempt used the name of a user account on my server. How did these names get found out?

Also, is there a way to monitor the incoming traffic so I can maybe see soem ip addresses of where these unsuccessful logons are coming from.

Thank you.

2 replies

by cg it

humm well if you have a FQDN, someone might have looked you up via WhoIS, did some packet sniffing on your public IP address to get the user information if its not encrypted then tried some of the more obvious password combinations. Lot of work though.

More likely senario is that its someone you either work with or know that could watch you enter your user name and password, then tried to use it themselves but wasn't able to correctly copy your password combination when they watched your fingers typing then spent time trying to figure out which letter or #s they got wrong.

by jcreaghan

Depending on what firewall system you are using. Any firewall that will log to a syslog server will allow you to capture traffic to a log, then using a log viewer or some reporting tools you can determine the IP addresses of some of the people trying to crack your system. For a syslog server, Kiwi make a pretty good free one.http://www.kiwisyslog.com/. A good reporting tool to use would be RNR ReportGen http://www.reportgen.com. These tools are a good start for a Server Admin to have in their toolbox.

This discussion is closed to new replies.