intruder

From: alin (aopran@emisystems.com)
Date: 01/15/03 

From: "alin" <aopran@emisystems.com>
Date: Wed, 15 Jan 2003 02:50:58 -0800

Hi,
I have a problem with an intruder. I found in Event viewer:
User Account Locked Out:
> > Target Account Name: Valentin
> > Target Account ID:
> > %{S-1-5-21-1343024091-1935655697-1060284298-1006}
Caller Machine
> > Name: AMDK7
> > Caller User Name: SERV$
> > Caller Domain: SERV
> > Caller Logon ID: (0x0,0x3E7)
This guy tries often to enter in our network. How can I
find his IP address ?
Thanks,
Alin

Relevant Pages

  • Re: Event id 627
    ... Target Account Name: ... Caller User Name: $ ... > Target Account Name: Marc Hillman ... > Target Domain: VULCAN ...
    (microsoft.public.win2000.security)
  • Re: How to capture text out of a few rows of info?
    ... > I'm not a VBScript person, so I need help coming up with a solution to ... > User Account password set: ... > Target Account Name: Testing ... > Caller User Name: Administrator ...
    (microsoft.public.scripting.vbscript)
  • Re: How to capture text out of a few rows of info?
    ... > I'm not a VBScript person, so I need help coming up with a solution to ... > User Account password set: ... > Target Account Name: Testing ... > Caller User Name: Administrator ...
    (microsoft.public.scripting.vbscript)
  • Re: administrator account locked!!!!
    ... I mentioned that because doesn't matter if you have the Admin ... Systems Administrator ... Target Account Name: Administrator ... Caller User Name: administrator ...
    (microsoft.public.windows.server.active_directory)
  • am i being hacked
    ... Component: Security Event Log ... Target Account Name: %1 ... Caller User Name: %4 ... This event record indicates that a disabled user account ...
    (microsoft.public.windowsxp.security_admin)