Windows 2000 Server Making SMB Logon Attempts to Worksations

From: ajm15@cornell.edu
Date: 12/05/02 

From: ajm15@cornell.edu
Date: Thu, 5 Dec 2002 15:40:09 -0500

Hello all, I've recently setup a personal firewall on a Windows 2000
Domain Controller. While there doens't seem to be any negative impact,
I'm seeing firewall log entries that are puzzling to me. It appears that
the server is making SMB logon attempts to some of my workstations as
well as other servers. These are failing.

I did some packet captures and examined what's happening. It appears
that "SYSTEM" is attempting an SMB logon from my server to other
computers and failing with "access denied".

Like I said, there doesn't seem to be any harm done from these, but I'm
curious as to the reasons why, and if possible how to resolve the
problem. AFAIK, there's no services that are running that should/would
do this.

Thanks much in advance for any input,
Adam Mikolajczyk
Systems Analyst, MCP
Cornell University
Planning, Design, & Construction