Re: Failure audit in security log
From: Eric Fitzgerald [MS] (ericf@online.microsoft.com)
Date: 11/02/02
- Next message: Eric Fitzgerald [MS]: "Re: Auditing AD: Analyzing event 565"
- Previous message: gabriele guasco: "exporting certificate request for offline signing and then re-import them"
- In reply to: AiKay: "Re: Failure audit in security log"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Eric Fitzgerald [MS]" <ericf@online.microsoft.com> Date: Fri, 1 Nov 2002 16:48:17 -0800
In Windows .NET Server we are adding the IP address of the remote client to
the logon audit. There's not much else to do after the fact with Windows
2000 or XP.
If you suspect that there is an attack (in other words worth your time), and
this is a recurring issue, you could set up NetMon (from Microsoft Systems
Management Server) and specify a capture filter to only capture interesting
traffic.
Eric
"AiKay" <iwazeer2@hotmail.com> wrote in message
news:u2rtoLbgCHA.2424@tkmsftngp11...
> Eric,
>
> Thanks for your answers. I already tried nbtstat and also checked my arp
> cache but didnt find anything.
>
> Imran
> "Eric Fitzgerald [MS]" <ericf@online.microsoft.com> wrote in message
> news:3dc18f3c$1@news.microsoft.com...
> > One more note: to actually see the remote machine's IP address, you have
> to
> > issue the command:
> > nbtstat -c
> > after the nbtstat -a command.
> >
> > Eric
> >
> > "Eric Fitzgerald [MS]" <ericf@online.microsoft.com> wrote in message
> > news:3dc18ef2$1@news.microsoft.com...
> > > If the workstation is on the same subnet as you, or if it points to
your
> > > WINS environment, then the following command will return the machine's
> IP
> > > address:
> > >
> > > nbtstat -a workstationname
> > >
> > > If the machine is not resolvable by WINS or broadcast, then no, you
> can't
> > > get any more information about it after the fact.
> > >
> > > Eric
> > >
> > >
> > > "AiKay" <iwazeer2@hotmail.com> wrote in message
> > > news:#F#gxFPgCHA.2256@tkmsftngp12...
> > > > I saw some Failure audits in my security log with Event Code Ids 529
> and
> > > > 681. The log (in event viewer) only shows a workstation name in the
> > > > Workgroup domain. Is there anyway I can find out more information
> about
> > > that
> > > > workstation or try to gather more information that will be useful
for
> my
> > > > network security person?
> > > >
> > > > Aikay
> > > >
> > > >
> > >
> > >
> >
> >
>
>
- Next message: Eric Fitzgerald [MS]: "Re: Auditing AD: Analyzing event 565"
- Previous message: gabriele guasco: "exporting certificate request for offline signing and then re-import them"
- In reply to: AiKay: "Re: Failure audit in security log"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
