Re: Someone is peeking my NT daily

From: Bosco Tsang (cn649@torfree.net.eh)
Date: 03/15/02 

From: cn649@torfree.net.eh (Bosco Tsang)
Date: Fri, 15 Mar 2002 14:27:07 GMT

Th problem is ...we don't have this workstation, and we don't have
this domain on record. However, one can make up these information.
That's what my question ...how can I know what that machine really is.
Anyway to at least get his mac address etc so I can check our router
log to locate it? 

--
On Thu, 14 Mar 2002 08:08:34 -0800, chris@nospam.com wrote:

>On Thu, 14 Mar 2002 15:15:27 GMT, cn649@torfree.net.eh (Bosco Tsang)
>wrote:
>
>>Daily (at least one, sometimes twice) our NT/W2K servers locked the
>>following nearly at the same time,
>>
>>EventID: 0x00000211 (529) - Logon Failure:
>>        Reason:         Unknown user name or bad password
>>        User Name:      BStewart
>>        Domain:         B_SNIPER
>>        Logon Type:     3
>>        Logon Process:  KSecDD
>>        Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>>        Workstation Name:       \\B_SNIPERsp
>>
>>How can I trace who this is, and how to block him from accessing our
>>servers? 
>
>
>What more do you need?  It shows the username and workstation.  If
>this workstation is on your network, they may just be browsing the
>network neighborhood.

Relevant Pages

  • Re: Someone is peeking my NT daily
    ... >How can I trace who this is, and how to block him from accessing our ... It shows the username and workstation. ... network neighborhood. ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Simple password Protect
    ... The username and password for Bob gives access to the folder Bob's ... No matter what user is logged on to the workstation, ...
    (microsoft.public.windows.server.networking)
  • Re: Analysis Services in a mixed Novell/Windows environment
    ... username as "domain\user" and pwd as the password. ... >> SQL BI Product Unit (Analysis Services) ... >>> My customer has a combined Novell/Windows networking environment. ... >>> workstation and is passing that on to SQL Server/Analysis Services. ...
    (microsoft.public.sqlserver.olap)
  • Re: event id 675
    ... workstation and uses a valid domain account name but enters a bad ... Failure Code 24.By reviewing each of your DC Security logs ... providing the username and domain name, ... address of the system from which the logon attempt originated. ...
    (microsoft.public.win2000.security)
  • Re: Simple password Protect
    ... I also have a local user on the server ... I went to a workstation browsed ... There is nor reason to have the username or password ... >> give you access to that folder. ...
    (microsoft.public.windows.server.networking)
Quantcast