Re: Hacker trying to get into our network

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Arretium wrote:
Additional info, here is what is showing up in my security log:

Security 529 3/2/2008 8:19 AM 11 *
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain: (my server's outside IP address)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: CHINAIPS-1013A
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 121.14.136.101
Source Port: 4239

I noticed that for Domain it listed my server's IP address. Is there
a reason he listed my IP address and not the name of my domain? Does
it matter?

First off if you have an open port, there will be pings. It's a part of life. If your passwords for remote access are long and strong, it doesn't matter how many times they try to knock on your door, you are still behind a strong password.

Now then what kind of firewall do you have?

If you want more protection to the admin account, use www.authanvil.com for two factor on that admin account.

If you have email open to port 25 and this pinging bothers you, look into www.exchangedefender.com and filter the mail and limit the SMTP to just the outsourced email filter IP addresses.
.

Relevant Pages

  • Re: You are not authorized to view this page
    ... AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Process: Kerberos ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: You are not authorized to view this page
    ... Here is the record from the Sytem Log for Kerberos ... AUTHORITY\SYSTEM BAY18 "Logon Failure: ... Logon Process: Kerberos ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Authentication failures
    ... Reason: Unknown user name or bad password ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)