Re: External logon attempt IP addresses

From: Phil (pmarg_at_charter.net)
Date: 07/31/03

  • Next message: Lasher: "Re: External logon attempt IP addresses" 
    Date: Thu, 31 Jul 2003 03:45:22 GMT

    "Lasher" <Lasher2014@hotmail.com> wrote in news:#tO#eMvVDHA.2012
    @TK2MSFTNGP10.phx.gbl:

    > I get a lot of attempts to log on to my win2000 server from the
    internet.
    > The event logs show the failures and the workstation names, but no IP
    > address. Is there a way to log the IP address of the attempt and then
    to
    > block that address?
    >
    > Thanks
    > Lasher
    >
    >

    I had the same problem a while ago. I downloaded the trial version of
    Sygate Personal firewall Pro from
    http://smb.sygate.com/products/spf_pro.htm
    I installed it on a workstation (I don't recommend putting it on a
    server). I set the firewall to "allow all" incoming and outgoing
    connections. I noted on the security logs the times that the events were
    happening and I checked the firewall logs for activity during that time.
    I noted some IPs that are not in are network. Right click on one of the
    IPs and it will back trace and bring up a computer name. After a while I
    hit on the culptrit computer name and I had an IP address to match with
    it. 

    -- 
Phil M.
MCSE NT/2000
  • Next message: Lasher: "Re: External logon attempt IP addresses"

    Relevant Pages

    • Re: Authentication failures
      ... Userenv eventid 1030 and Userenv eventid 1006 logged? ... Did you change the workstation SID? ... restictions on the "Mike Bannister" account, ... lastly the user never logs in on any other workstation so simultaneous ...
      (microsoft.public.windows.server.sbs)
    • Re: Help! Norton Personal Firewall 2003 periodically blocks access to internet
      ... Have you looked at the event logs (and especially the firewall event ... > Just the other day when this happened, on a whim, I disabled NPF 2003 ...
      (comp.security.firewalls)
    • Re: Authentication failures
      ... If yes I would be leaning torwards a corrupt profile. ... lastly the user never logs in on any other workstation so simultaneous ... The user logs in every day. ... Logon Failure: ...
      (microsoft.public.windows.server.sbs)
    • Re: Permit only one network logon per user
      ... I assign a unique username and password per user of this service. ... Alice logs on at workstation A. Alice then logs on at workstation B, ...
      (microsoft.public.windows.server.security)
    • Re: Norton personal firewall causing problems with MSN8
      ... What do you see in the various NPF event logs when this ocurs? ... I'm running NIS on three different ... encrypted the basic firewall configuration settings, the firewall rules, and ...
      (comp.security.firewalls)