Re: Help attempting to get hacked?

From: John (jonashbaugh_at_hotmail.com)
Date: 08/06/03 

Date: Wed, 6 Aug 2003 07:35:26 -0700

Sorry,
        Here it is:

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 644
Date: 8/6/2003
Time: 6:54:03 AM
User: Everyone
Computer: WCPCI-01
Description:
User Account Locked Out:
  Target Account Name: ekeller
  Target Account ID: WCPCI\ekeller
  Caller Machine Name: PAMELAMAIN
  Caller User Name: WCPCI-01$
  Caller Domain: WCPCI
  Caller Logon ID: (0x0,0x3E7)

Thanks in advance John

"Terese" <twojtowi@cmsins.com> wrote in message
news:OGCXibCXDHA.736@TK2MSFTNGP09.phx.gbl...
> You said "like below" ... did you forget to attach something?
>
> "John" <jonashbaugh@hotmail.com> wrote in message
> news:eisNMZCXDHA.2360@TK2MSFTNGP12.phx.gbl...
> > Hello,
> >
> > We just went for NT 4.0 to win2k and running all current SP and
> > security patches. The users have been getting locked out all of the
> sudden.
> > I thought it was due to the misconfiguration of the DNS on the DC
however
> I
> > looked at the security event log and found multiple entries like the one
> > below. This machine name is not even on our network. How can I prevent
> this
> > from happening as it seems someone is trying to get our users password
for
> > access. How are they able to get into our LAN? Could this be generated
> when
> > someone is trying to get into our FTP? Thanks in advance..
> >
> > John
> >
> >
>
>

Relevant Pages

  • Re: account locked out multiple times per day
    ... recently I pulled the account from domain ... Event Source: Security ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • am i being hacked
    ... Component: Security Event Log ... Target Account Name: %1 ... Caller User Name: %4 ... This event record indicates that a disabled user account ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Account management audit
    ... if you add or remove a user account object from ... > Target Account ID: ICB\ralfeus ... > Caller Domain: ICB ...
    (microsoft.public.win2000.active_directory)
  • Re: Account management audit
    ... Event Category: Account Management ... Target Domain: ICB ... Target Account ID: ICB\ralfeus ... Caller Domain: ICB ...
    (microsoft.public.win2000.active_directory)
  • Re: Log Information
    ... Description: User Account Deleted: ... Target Account ID: %3 Caller User Name: %4 ... Audit account managementhttp://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/g ... ...
    (microsoft.public.exchange.admin)