how to block intruder attack

From: Asanga (asanga@idnw.com)
Date: 08/12/02 

From: "Asanga" <asanga@idnw.com>
Date: Mon, 12 Aug 2002 08:31:12 -0700

I see on my security logs - login failed from workstation
that we don't recognize. How do I capture their IP and
block them from intruding the server further. Below is an
example from security log:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 8/11/2002
Time: 2:35:58 PM
User: NT AUTHORITY\SYSTEM
Computer: SMSWEBSVR
Description:
Logon Failure:
         Reason: Unknown user name or bad password
         User Name: TRAVELMEDIA
         Domain: WG47
         Logon Type: 3
         Logon Process: NtLmSsp
         Authentication Package:
        MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
         Workstation Name: \\SABRENET

Relevant Pages

  • re: Brute-force and IIS/w2k logs
    ... > I've just reviewed a short range of security logs on ... > invalid login attempts. ... > way to capture the IP address of the source? ... Do you Yahoo!? ...
    (Security-Basics)
  • Re: Cannot browse to a domain controller across windows domains
    ... There are no security audit entrys success ... > or failure in the security logs when I try to log on...as though the ... > workstation which I am trying to browse the DC with has never contacted ... > to the domain controller of the outside domain. ...
    (microsoft.public.windows.server.networking)
  • Re: Auditing Account Logons
    ... I'm seeing it in the security logs when logged directly on to the DC via ... remote desktop from a workstation. ... >> I need to audit when a user logs on to the domain from a workstation. ... >> workstation they are logging in from. ...
    (microsoft.public.windows.server.security)
  • Re: Auditing Account Logons
    ... Are you seeing this when viewing the security logs while logged ... > I need to audit when a user logs on to the domain from a workstation. ... > Domain Controller policy, I enabled "Audit Account Logon Events ...
    (microsoft.public.windows.server.security)
  • pls help
    ... I have since yesterday had so many events in my security logs for users and workstatiosn which are not even in my LAN ... The logon to account: ibm ... from workstation: ASYLUM ...
    (microsoft.public.win2000.security)