repeated logon attempts at different ports of same IP

From: Mark D. Meyer (MarkDMeyer_at_discussions.microsoft.com)
Date: 03/29/05 

Date: Mon, 28 Mar 2005 19:51:02 -0800

Help !

I have one workstation that is attempting to logon over and over at
different ports. It will try 2536, then .20 seconds later, 2539 and so on. I
have reloaded the XP Pro workstation from scratch and it reappeared
immediately. This will go on for thousands of times a day.

I am running McAfee VirusScan Enterprise 8.0i, McAfee Desktop Firewall,
SpyBot Search & Destroy, and Ad Aware. None of them can detect anything. I
have my MS Windows 2003 Server locked down pretty tight, but really need to
know what it testing my security over and over. I checked with my ISP and
nothing out of the ordinary is going out over the internet either.

Any help will be very appreciated. Sleep will come next.....

Thanks...

Mark

Relevant Pages

  • Repeated logon attempts from different ports of same IP
    ... I have one workstation that is attempting to logon over and over at ... different ports. ... I am running McAfee VirusScan Enterprise 8.0i, McAfee Desktop Firewall, ...
    (microsoft.public.security)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Users cannot access remote web workplace without admin access
    ... RWW site logon issue ... When we create the user accounts by using the SBS add users ... workstation through the RWW-RDP connection? ... For the RDP access issue, it could be an expected behavior. ...
    (microsoft.public.windows.server.sbs)
  • Re: How list all current logon NT domain users?
    ... > last logon time, but not give the logoff time. ... required to exist while the user remains logged on to a workstation or TS ... "agent" on every single workstation, ...
    (microsoft.public.win32.programmer.kernel)