Re: Help with possible hacker...

From: Ben Verhagen (B.Verhagen1@Chello.nl)
Date: 01/02/03 

From: "Ben Verhagen" <B.Verhagen1@Chello.nl>
Date: Thu, 2 Jan 2003 21:49:14 +0100

As far as i understand Q273499, in this case youre server is not hacked, but
something is trying to gain acces with a locked-out account:
http://support.microsoft.com/default.aspx?scid=KB;en-us;q273499
      3221226036 C0000234 User logon with account locked

Regards,
Ben Verhagen.
"Tom Rossi" <TomRossi7@yahoo.com> wrote in message
news:cb00dd30.0212310622.4a922227@posting.google.com...
> I continue to get a group of login failures every few days. The login
> attempts spread all of the local accounts on one of my servers. I
> cannot tell from the security log the IP address of the hacker. Is
> there somewhere else I can look? Please help...
>
> Here is an example from the event log:
>
> 12/23/2002 12:18:25 PM Security Failure Audit Account Logon 681 NT
> AUTHORITY\SYSTEM SERVERNAME The logon to account: MemProxyUser1
> by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> from workstation: SPSERVER
> failed. The error code was: 3221226036
> 1

Relevant Pages

  • Re: Re-Post - "the trust relationship between this workstation and the
    ... "the trust relationship between this workstation and the primary domain ... only problem is adding a new user account on the station. ... Client computer must use STRICTLY the INTERNAL DNS server which can ... Attr: subschemaSubentry ...
    (microsoft.public.windows.server.active_directory)
  • Re: Same question, still no answer!!!
    ... Sounds then like we are all paying for a feature set only large companies ... The "proxy server" pc is actually an older box stuffed ... Expectation #1) keep the ethernet more or less as is. ... The kids account would be ...
    (microsoft.public.windowsxp.basics)
  • Re: Re-Post - "the trust relationship between this workstation and the
    ... "the trust relationship between this workstation and the primary domain ... only problem is adding a new user account on the station. ... This would be on the DNS server 172.20.100.2 ... Attr: subschemaSubentry ...
    (microsoft.public.windows.server.active_directory)
  • Sending email to mydomain.com
    ... server will appear as undeliverable. ... This happens because you are using the POP3 connector... ... an NDR when an account doesn't exist). ... >different from the user account names for the exchange ...
    (microsoft.public.windows.server.sbs)
  • Re: Basic Authentication + IIS 5 + Windows 2000 + Frontpage 2002 = failure?
    ... administrator account -- we should have no problems at least browsing to ... server. ... | authentication dialog box. ...
    (microsoft.public.inetserver.iis.security)