Re: Another security question/issue.

Please post the complete events including event id and accounts numbers.
There should really be nothing in there that would be an issue for public
posting.

For the Mdaemon, that would be typical of a third party email product. If it
exists on your SBS server then it should be by intent, not by accident.

The first event is missing the username and logon process appears 'munged'.

In example 2, adavpi is IIS if that helps.

sbsstarter wrote:
Here are posts of the failed login attempts:

22 occurrences
Logon Failure:
Reason: Account currently disabled
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: MYSERVER-SBS
Caller User Name: MYSERVER-SBS$
Caller Domain: MYSERVER
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 876
Transited Services: -
Source Network Address: -
Source Port: -

--and--

Logon Failure:
Reason: Unknown user name or bad password
User Name: MDaemon
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: MYSERVER-SBS
Caller User Name: MYSERVER-SBS$
Caller Domain: MYSERVER
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1492
Transited Services: -
Source Network Address: -
Source Port: -


and, no I have not changed the administrator account password, but I
have changed the password of the active administrative user account.


"kj [SBS MVP]" wrote:

sbsstarter wrote:
Ok; I get daily hits to the disabled admin account. Event log tells
me they are denied access. First, I was told the reason the attempts
are higher than my lockout policy is because policies don't apply to
admin account - correct? How can I find out who is making these
attempts and how I can deny that individual access? The most
annoying instance happens very close to the same time every morning
at about 4:00 a.m. The logs don't give an address of the user
trying the attempted logins. What are my options?

Post an example of your failed logon attempt.

Is your administrator account 'disabled' by choice, or are you
saying it's disabled by lockout policy?

While this may be an external cause, it may also be an internal
driven event. Did you change the administrator password lately?

Policy applies to all accounts, but the administrator has some
protections against denying the true administrator (person) from
gaining access to the server.





Second, if the account is obviously disabled, why would a hacker
keep attempting to access it? It's not going to work...right?



Third, I've been noticing fail authentication attempts with the user
name MDaemon. Is that an actual service that I need to deal with, or
is it an attempt at unauthorized access?

Post one of these too.

Finally....if I've closed all ports except 25 TO the SBS box from my
external firewall appliance, why am I still seeing failed
authentication attempts on a daily basis? Is it possible to attempt
a login through port 25 which is designated for exchange?

--
/kj

--
/kj


.

Relevant Pages

  • [EC-SA-01.2003] Windows XP "welcome screen" exposes the names of all the members of the l
    ... logon screen with what is called "Welcome Screen". ... (including the original administrator account, ... Using the "welcome screen" actually disables / ignores the security ...
    (Bugtraq)
  • Re: Is it really true that NTFS is secure?
    ... > and failure auditing starting with "Audit Account Management," and also try ... > The account Group got put back in the Administrator group again. ... > The logon to account: ...
    (microsoft.public.security)
  • Re: Please help refresh my memory on AD DC
    ... When I boot my Laptop I reach the Logon screeen for XP Laptop and here I am ... administrator account. ... account to be able to Login so I can control it from the DC. ... A Server has websites already hosted on it in a Workgroup and now I join it ...
    (microsoft.public.windows.server.active_directory)
  • Re: Windows Logon Screen Changed and classic style now shows....
    ... computer you have a box in classic style saying windows is logging off. ... login name is the administrator with NO password. ... One of the updates for .net framework adds a user account. ... what causes the extra logon step. ...
    (microsoft.public.windowsxp.accessibility)
  • Re: Administrator access denied
    ... When you run the command net user username where username is the logon name ... for your user account it show the account is active. ... Home you can only logon to the built in administrator account in Safe Mode. ...
    (microsoft.public.windowsxp.security_admin)