Re: Security log errors 529, store.exe

"These attempts were effectively stopped after we disabled all authentication to the SMTP virtual service except Anonymous access (for those who legitimately submits their mail in"

Exactly what did you change there? Not sure i understand the setting you changed?

www.exchangedefender.com

Put a mail filtering in front of the server, close port 25 to only respond to the servers www.exchangedefender.com forwards from.

Unless that pop3 is ssl based pop3, you are transfering that username/password over clear text.

If you have ports, people will bang on them.

You said it yourself... you have all the email ports open. They are knocking. They want to guess/see if you have a sucky password.

As far as the IP you'll need to track this back through to your firewall logs.

Alex Persky wrote:
Hi

We're periodically having series of errors 529 in the security log on a Windows 2003 SBS. Usually they come like 2-10-40 logon attempts within 2-3 minutes, never on weekend, which suggests someone's periodically trying to hack in, every couple of days.

Here's a sample event

Event ID: 529
Computer: SERVER
Category: logon/logoff
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SERVER
Caller User Name: SERVER$
Caller Domain: (a proper SBS's domain name here)
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 4180
Transited Services: -
Source Network Address: -
Source Port: -

The PID belongs to store.exe (= Exchange).

We used to experience similar series of 529 errors before with caller process inetinfo.exe which we figured out were related to someone trying authenticate to our SMTP with usernames like webmaster, info, guest, administrator. These attempts were effectively stopped after we disabled all authentication to the SMTP virtual service except Anonymous access (for those who legitimately submits their mail in).

But this time we're getting similar logon failures logged by store.exe! The only services published (i.e. accessible from outside) are IMAP, SMTP and POP3, and also OWA (Outlook web access) and the website. I've found nothing relevant in SMTP and web logs. POP3 unsuccessfull logons don't generate such events.

The question is: how they're doing this? what kind of hole in our system could possibly exist?
And finally we would like to find an IP address of whoever is doing this.

Please don't suggest:
1. restart the server -- we restart it regularly
2. boot it into the safe mode -- we can't afford any interruptions to the work of the system, too much depends on it
3. change the administrator password to a better one, introduce policies to force the users to change them regularly -- we already have very good and very long passwords.


Thank you
Alex


.

Relevant Pages

  • Re: ISA SERVER NOT STARTING
    ... I delete the nat/basic firewall and stop and started the RRAS an tried to ... There were no critical events in the DNS Server Log in the last 24 hours. ... An error occurred during logon ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Event ID 529
    ... First is a hardware firewall that sits on the perimeter of your network and requires that your users give user names and passwords, different from those for the network. ... Sometimes the Logon Type is different, also the User Name can be ... Computer: <SERVER NAME> ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)
  • Re: Another security question/issue.
    ... Time to audit your server and workstations with AV, Malware, and installed ... Logon Process: Advapi ... Caller User Name: servername$ ... Source Port: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... connection has been found on the black list, my DNS server ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)
  • Re: Logon 529 Errors
    ... Default SMTP Virtual Server properties-Access tab-Relay ... Connection filtering is different from what inna is attempting, ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
    (microsoft.public.windows.server.sbs)
Loading