Windows Forum

Ask something
Discussion Locked

Security Log

0 helpful
8 replies

by ittech2

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I see this quite often in my event log and feel that
someone is attempting to get into my servers/network.

When this happens, I notice that the account names are our
entire users accounts. Like this one started at 6:44:19
and had about 120 event ids 681 and 529. Each with the
different logon accounts.

The logon to account: administrator
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: AMSTERDA-R50NAC
failed. The error code was: 3221225578

They are all failed, but should I be concerned and is
there a way that I can track this guy/gal down? The
workstation changes not each time but each day. This
person has been attempting this for the past 4 weeks, with
no luck. All have failed.

Thanks

8 replies

by rabbit_runner

My answer will be from several directions.....
1. If you stronly believe that this is an attack by a Hacker, then the first thing to do would be to re-name the administrator account. Any windows server automatically creats the master account as administrator. Hackers know this. Therefore, re-name the account. At the same time, create a dummy account named 'administrator' and then dis-able that dummy account. Also, change the password for the 'new_administrator' account. Make it tough, likeUpper case letters, Lower case letters, number, and special character.
NOTE: when you do this, check any service accounts or software packages which may depend on the account(s) that have been changed. You will need to modify them to use this new account and password.
2. Do you recognize the workstation name of AMSTERDA-R50NAC? Could this computer name be on your local network? Or could it be a dial-in computer that is attempting to access your network? Double check. I do not know how large your network is, but check thoroughly.
3. If you are absolutely certain this is a hacker, then change the firewall settings to exclude this person, IP address, and computer.
4. Get a sniffer program. One that will give you more detailed information on this person and computer. From there see if you can track him.

Hope this helps.

by sparky123456

I think you should be concerned, you could use the times and workstations as a clue to who and when...

by joseph moore

If you are seeing multiple logins fail from a single workstation name using multiple user accounts, then YES SOMEONE IS TRYING TO HACK YOUR NETWORK!
It doesn't get much clearer then that.

Look at your LAN design and think: what machine(s) have TCP ports 135, 139 and/or 445 open to the Internet??? Apparently at least 1 machine is!

Now, you don't mention on what machine you have these failed logon attempts in the Security log. Is it a stand-alone web server, or on a Domain Controller? If it is on a domain controller, then the hacker is trying to penetrate the password security on one of your domain members (either a Server or Workstation). If the password for an account is cracked, then your entire LAN is up for grabs!

If you run a firewall (and I hope you do!!!) check its rules to see what machines are open on the ports I listed. There are a lot of automatic Windows password crackers out there. They download the usernames from the SAM, and then run the password cracking routing against those user names. This is why I am not the biggest fan of just relying on having the Administrator account renamed. If you have a tool that can read the SIDs for the accounts, you can find the Administrator account with no problem!

I would look at your perimeter security and find the holes there. Feel free to contact me if you need a hand.

Good luck.

by joseph moore

BTW, since you must have a good idea on what time of day these attacks happen (since you state its been going on for 4 weeks!!!), then you CAN find the IP address of the attacker.
Be there when the attacks usually happen.
Keep an eye on the Security log.
When you see it start filling up with the failed logon attempts, open Computer Management on the machine that is being hacked.
Open Shared Folders -> Sessions
When the hacker is running his script kiddie password cracking program, the IP address he/she is using will be listed, since the password cracking routing establisehes a Session.
The Computer column in Sessions will list their IP address!
Now, once their automated routing stops, this Session will probably disconnect, so it won't be listed. That is why you need to check right when they are trying to break in!
Once you have their IP address, you "possibly" have them. Sure, they could be tunneling through a SOCKS server, or they could be using a zombie to attack you, but if it is only a script kiddie you will see THEIR IP address.
And then you can start legal procedings. YOu can contact their ISP. YOu could contact your ISP and see what kind of legal mess they could start.
You could fight back, but that is illegal.

hope this helps

This discussion is closed to new replies.