Windows Forum

Ask something
Discussion Locked

Security: TCP/IP address for connections

0 helpful
4 replies

by rbaker

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Security events in Event Viewer displays information about what workstation is attempting to log in, as well as what domain they are attempting to log in from.

That is all well and good if the information is valid.

I am seeing failed login attempts from invalid domains and workstations. But I would like to get the IP address of these systems without resorting to peering through a protocol analysis.

4 replies

by joseph moore

If you are running a WINS server, that might have a record of the IP address and machine name of the intruder. If you do run WINS, look in its database.

by rbaker

I hate to say this answer was unacceptable, as if I were running WINS, it might have helped. My question did not provide enough detail to have eliminated this possibility.

Answer 2 provides additional information about this problem.

by rbaker

Additional Information:

This server is in question is standalone. There is no Domain or Active Directory at the site in question. WINS and IIS is not used in this environment. TCP/IP is the only protocol required, and is the only protocol installed.

This discussion is closed to new replies.