Re: Watching event logs for workstation/user logons

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance



In news:23028425-1F25-4806-A0F0-49D74E8D2C88@xxxxxxxxxxxxx,
Mark <fastzrex@xxxxxxxxxxxxxxxx> typed:
Hello! Not being an event log expert, I need some adice on what to be
concerned about regarding workstation/user account logon and
logon/logoff in the Security logs.

I suspect, after reviewing my Security Logs on my SBS2003 server,
that there is a compromised user account.

What makes you think so? Is there anything funky going on on your
server/network?

I see what I would call
suspicious activity between midnight and 6 AM, with user
logons/logoffs, etc.

What accounts? Those of your actual users? Might they be using RWW at the
time?

I have several users who leave their
workstations on all night,

....but logged out, right?

while they are not in the facility, but
may access via RWW.

Are there whitepapers which help a novice make sense of what is
'normal' and 'abnormal' activity in the security logs concerning
'Account Logon' and 'Logon/Logoff'?

Do you see any failures, or only successes?

I am also seeing some
Login/Logoff for the user IUSR_ServerName in the early hours, and not
sure if this is to be expected and normal. Any suggestions from
personal experience?

That's used for IIS - so this could be OWA, could be RWW, whatnot. Probably
also for internal purposes.

I understand how to use the filter capabilities of the Event Logs to
home in specific events, but I need to know what to expect to find.

Thanks for the help!

I guess I'd have to ask first what you're suspicious *of*.... you can crank
up auditing on all sorts of things if you want to pore through the logs, but
it helps if you know what you're looking for (privilege escalation, etc).
Otherwise you will be facing a huge task of reviewing i& filtering it all.

Important questions might include:
Are all your servers/clients fully patched? Do you have a good complex
password policy in place (8-char minimum)? Force regular changes? A good
firewall apliance and/or ISA? What's open inbound from the Internet? What
antivirus software are you running? (And so on and so forth.)


.

Relevant Pages

  • Excessive Logon/Logoffs
    ... I was reviewing my Security logs on my Server 2003. ... I noticed a lot of logon/logoff activity that seems to be going on continuously during hours of the day when no one is even in our offices. ...
    (microsoft.public.windows.server.security)
  • Re: Security Logs are hard to read
    ... normal security network traffic to clean the stuff in security logs. ... we usually use Filter function in Event Viewer to clean ... Is the server box running on the SBS 2003 server? ... server status report for you to monitor the server to ensure the server ...
    (microsoft.public.windows.server.sbs)
  • Re: Almost hacked, Need assistance please
    ... are exposed such attacks will almost certainly occur. ... which the security logs can be helpful in identifying such. ... > I'm new to servers and to Server 2003 so I'm going slowly and trying to ... > lockouts and lockout thresholds and reviewed security policies but here ...
    (microsoft.public.windows.server.security)
  • Re: Mac OSX and AD
    ... enabled if you wanted to see anything in the security logs. ... >> shares on the Windows 2003 server. ...
    (microsoft.public.windows.server.active_directory)
  • Cannot read sys/sec event logs via WMI
    ... My app is having trouble reading the system and security logs from some ... My app works fine with application logs over the network, ... PC running the same OS (W2k server) and service pack. ...
    (microsoft.public.win32.programmer.wmi)