Re: Multiple Failed Password Change Attempts!

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 11/07/04

  • Next message: Peter Kaufman: "Add ipsec certificate template" 
    Date: Sun, 7 Nov 2004 03:12:45 -0700

    Are you sure about the time of these, as this is something one
    will see as a result for running MBSA with use of the option
    to check account passwords. 

    -- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"a" <a@a.com> wrote in message
news:%23ihLVw%23wEHA.1292@TK2MSFTNGP10.phx.gbl...
> In the last 2 months there have been two occasions on my Windows 2K Pro
> machine in which many multiple change password attempts have been recorded
> in my security log. On both occasions about 50 change password attempts
were
> recorded, in rapid succession (1-2 seconds of each other), all against my
> local user accounts, being the guest account (renamed BrendanGuest,
> passworded and disabled) as well as other user accounts. Interestingly the
> PETER user account present on my PC was not targeted at all - note that
the
> PETER PC is the ICS host and gateway to the internet in my LAN.
>
> Attached is an example from my security log of what has happened. As you
can
> see the change password attempts were down under my user name (I am the PC
> administrator) and using my privileges.
>
>
> What on earth is going on here? Both times these things occurred I was
> offline. I have run almost every security test/scan known to man including
> the Microsoft baseline security analyser to no avail.
>
> My PC specs are as follows:
>
> Win2K Pro SP4 completely up to date with all hotfixes
> ZoneAlarm Pro 4.5.538.001 with auto-clean cache/cookies/temp every day
> Norton Antivirus 2004 Pro completely up to date
> Ad-aware 6, Spyware Blaster, SpyBot with host file locked/various other
> security features completely up to date
> Peerguardian
>
> Can someone enlighten me with this? All help appreciated.
>
>
>
  • Next message: Peter Kaufman: "Add ipsec certificate template"

    Relevant Pages

    • Multiple Failed Password Change Attempts!
      ... In the last 2 months there have been two occasions on my Windows 2K Pro ... On both occasions about 50 change password attempts were ... local user accounts, being the guest account (renamed BrendanGuest, ... Attached is an example from my security log of what has happened. ...
      (microsoft.public.win2000.security)
    • Re: Multiple Failed Password Change Attempts!
      ... is not included and non default user accounts are being used which indicates ... auditing for "logon events" which can also help detect attacks. ... On both occasions about 50 change password attempts ... > Attached is an example from my security log of what has happened. ...
      (microsoft.public.win2000.security)
    • Re: Sharing Resources On A Windows Network
      ... > Dan N wrote: ... >>>XP Pro can join a domain, ... > If security isn't an issue, ... create user accounts on the print server that ...
      (comp.os.linux.networking)
    • RE: 2 users 1 workstation
      ... I first checked the DNS forward look up, ... Updated the registry keys for the clients and security policies, ... Migrate-- strBat - [C:\Program Files\Microsoft Windows Small Business ... what it is (i created most of the user accounts of the same way, ...
      (microsoft.public.windows.server.sbs)
    • Re: restrict access to AD:USER properties for a particular set of
      ... The settings that you define at the OU permission level ... to advanced security settings, selct add, select Jane Doe and then ther ... You can choose user accounts, ...
      (microsoft.public.windows.server.active_directory)