Help with possible hacker...
From: Tom Rossi (TomRossi7@yahoo.com)
Date: 12/31/02
- Next message: Ryan Lambert: "Re: Win2K login problem"
- Previous message: Luis Serpa: "Help Urgent"
- Next in thread: Server: "Re: Help with possible hacker..."
- Reply: Server: "Re: Help with possible hacker..."
- Reply: Joe Richards [MVP]: "Re: Help with possible hacker..."
- Reply: Karl Levinson [x y] mvp: "Re: Help with possible hacker..."
- Reply: Ben Verhagen: "Re: Help with possible hacker..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: TomRossi7@yahoo.com (Tom Rossi) Date: 31 Dec 2002 06:22:29 -0800
I continue to get a group of login failures every few days. The login
attempts spread all of the local accounts on one of my servers. I
cannot tell from the security log the IP address of the hacker. Is
there somewhere else I can look? Please help...
Here is an example from the event log:
12/23/2002 12:18:25 PM Security Failure Audit Account Logon 681 NT
AUTHORITY\SYSTEM SERVERNAME The logon to account: MemProxyUser1
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: SPSERVER
failed. The error code was: 3221226036
1
- Next message: Ryan Lambert: "Re: Win2K login problem"
- Previous message: Luis Serpa: "Help Urgent"
- Next in thread: Server: "Re: Help with possible hacker..."
- Reply: Server: "Re: Help with possible hacker..."
- Reply: Joe Richards [MVP]: "Re: Help with possible hacker..."
- Reply: Karl Levinson [x y] mvp: "Re: Help with possible hacker..."
- Reply: Ben Verhagen: "Re: Help with possible hacker..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
