Re: Logon failure on disabled Administrator account
- From: "Les Connor [SBS Community Member - SBS MVP]" <les.connor@xxxxxxxxxxxx>
- Date: Tue, 21 Nov 2006 10:24:37 -0600
A workaround is to remote into your "home" system (that has the allowed IP
address), and then connect from there to the customer.
--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
----------------------
"Tell me and I'll forget. Show me and I'll remember. Involve me and I'll
understand." - Confucius
"Bruce Wilkinson" <BruceWilkinson@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:DFB0E77F-2823-4EF9-AD85-36BBF44B5B21@xxxxxxxxxxxxxxxx
Steve:
That works if I only remote in from known locations. But if f I'm out at
another client's and this one calls in, I'm stuck. I may start adding
select
clients IPs though. That would allow finer grain control and only force me
to
reconfigure the firewall if I'm somewhere else.
Thanks.
"Steve" wrote:
If you have ISA 2004 installed you can use that to allow in only the
specific remote IPs you need to connect to 3389 for administration.
"Bruce Wilkinson" <BruceWilkinson@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:D50A7A50-14F1-4776-AF72-ECB8AC50C075@xxxxxxxxxxxxxxxx
The attempts to connect are coming in over port 3389, the terminal
services
port. I use it for remote administration.
Isn't it considered good security practice to disable Administrator and
use
another account for administrator tasks. Doesn't Microsoft recommend
it? I
know many others do.
Bruce
"Lanwench [MVP - Exchange]" wrote:
In news:55B9E1A8-90AF-4CD7-A3D2-595E6E6F894D@xxxxxxxxxxxxx,
Bruce Wilkinson <BruceWilkinson@xxxxxxxxxxxxxxxxxxxxxxxxx> typed:
I disabled the administrator account for security purposes,
primarily
because someone periodically tries to brute force the account. Since
then I get Security event 531 about 15 times each night on account
DC1$. The computer name is dc1. Is event monitoring or some other
scheduled task triggering this event error? All scheduled events
that
I control are using the new admin user account.
Bruce
Don't disable the administrator account. Frankly, in SBS, I've had
problems
even *renaming* it.; there are plenty of services and inner workings
that
expect it to be there & expect it to be called administrator
(particularly
your monitoring stuff). Just set an impossible-to-guess password on
it.
Where are the brute force attacks coming from, and if this is outside
your
network, over what ports are they coming in - and what kind of
firewall
protection do you have?
.
- Follow-Ups:
- References:
- Re: Logon failure on disabled Administrator account
- From: Lanwench [MVP - Exchange]
- Re: Logon failure on disabled Administrator account
- From: Steve
- Re: Logon failure on disabled Administrator account
- Prev by Date: RE: RWW: version=1 msgtype=status status=-3 message=Password Inco
- Next by Date: Re: Where to buy SBS
- Previous by thread: Re: Logon failure on disabled Administrator account
- Next by thread: Re: Logon failure on disabled Administrator account
- Index(es):
Relevant Pages
|
Loading
