Another security question/issue.

Ok; I get daily hits to the disabled admin account. Event log tells me they
are denied access. First, I was told the reason the attempts are higher than
my lockout policy is because policies don't apply to admin account - correct?
How can I find out who is making these attempts and how I can deny that
individual access? The most annoying instance happens very close to the same
time every morning at about 4:00 a.m. The logs don't give an address of the
user trying the attempted logins. What are my options?

Second, if the account is obviously disabled, why would a hacker keep
attempting to access it? It's not going to work...right?

Third, I've been noticing fail authentication attempts with the user name
MDaemon. Is that an actual service that I need to deal with, or is it an
attempt at unauthorized access?

Finally....if I've closed all ports except 25 TO the SBS box from my
external firewall appliance, why am I still seeing failed authentication
attempts on a daily basis? Is it possible to attempt a login through port 25
which is designated for exchange?
.

Relevant Pages

  • RE: Solution: web application can not access event log
    ... I create the event log and source using an admin account and have no problem ... I am using integrated windows authenticaiton in IIS and windows ...
    (microsoft.public.dotnet.security)
  • Re: Event Logging from ASP.NET
    ... create using program that runs under Admin rights. ... user to first run some type of desktop app, ... under Admin account. ... Then your ASP.NET will be able to write into event log. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: source of Failure Audits is Default Web Site
    ... trying to crack the Admin account, whatever they are doing depends on having ... that website stops these errors. ... But maybe I'm misreading the Event Log. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Event Logging from ASP.NET
    ... it only once simply have a desktop program that does it and run it under ... Admin account. ... Then your ASP.NET will be able to write into event log. ... Can you write if you are using the ASP.NET account or Network Services ...
    (microsoft.public.dotnet.framework.aspnet)
Loading