Re: Hacking attempts?

How are you determining that these are RWW login attempts? What is the
actual security event being logged?

"JEC" <thejohncarlson@xxxxxxxxxxxxxxxxxxx> wrote in message
news:9852BEC9-023D-48CE-BE82-5AC1744D3081@xxxxxxxxxxxxxxxx
I am a computer consultant who manages a dozen SBS 2003 networks. About a
week ago, I received my daily report and noticed there had been 1700 failed
login attempts on this server. Upon examining the security logs, I
discovered that there were 9 login attempts a second, trying to login to
the RWW with random user names. It did not appear that any were successful.

Yesterday afternoon, it happened to another one of my customers. 1100
login attempts to the RWW in a very short amount of time. All with random
user names. Again it appeared none were successful.

Has anyone else seen anything like this happening?

My servers are completely patched, and all users have very strong
passwords. Anyone else have any suggestions of steps I should take to
prevent this?

Is there a way to limit the number of login attempts to the RWW?

Any help is greatly appreciated.


.

Relevant Pages

  • RE: RWW slow login
    ... | Content-Class: urn:content-classes:message ... | Sender: "Eubanks" ... | Subject: RWW slow login ... | speed up login for users that aren't domain admins?? ...
    (microsoft.public.windows.server.sbs)
  • Re: OWA through RWW requires second log on
    ... As I recall - this has something to do with the login names and/or email ... Les Connor [SBS Community Member - SBS MVP] ... Yes, when you have the RWW interface on the screen, you click on the OWA ...
    (microsoft.public.windows.server.sbs)
  • Re: Hacking attempts?
    ... OWA also runs on 443 as does HTTP/RPC, but I believe the logon Type:3 as you ... Caller User Name: SERVER$ ... only externally exposed IIS is the RWW. ... been 1700 failed login attempts on this server. ...
    (microsoft.public.windows.server.sbs)
  • Re: RWW & Monitoring and reporting
    ... Notice the original http and the forward to https. ... As far as the login to RWW, it sounds like the companyweb screen, but I ... When logging into OWA it appears as it should for the login. ...
    (microsoft.public.windows.server.sbs)
  • Re: Remote Web Workplace Will not Allow Users to Logon
    ... You should not have to use the Domain name to login through RWW. ... What do you mean you are able to connect to the Client PC's but not able to login? ... MCP Microsoft Small Business Specialist ...
    (microsoft.public.windows.server.sbs)