Re: Failed Login Attempts-Non Existent Accounts
From: JM_Metal (JMMetal_at_discussions.microsoft.com)
Date: 03/25/05
- Previous message: Roger Abell: "Re: migrate win2000 to win2003 (.vbd)"
- In reply to: Steven L Umbach: "Re: Failed Login Attempts-Non Existent Accounts"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 25 Mar 2005 07:05:08 -0800
Thanks Steven---We do run the MSBA and it has helped plug some holes, and we
tightened up as much as possible on services. The perf logs and alerts link
looks like a good place to start.
Jeff
"Steven L Umbach" wrote:
> First I would make sure that your firewall is correctly configured and that
> the server is properly hardened in that unnecessary services are disabled.
> MBSA can help you with that and keep in mind that file and print sharing
> should be disabled on servers that do not need it and all external network
> adapters. If you have file and print sharing ports exposed to the internet
> you certainly will get hit with a lot of brute force password attacks. If
> you deny the IP address at your firewall device it should not degrade the
> server's performance. You might be able to use performance monitor to alert
> you is failed logon attempts go beyond a threshold you define. --- Steve
>
> http://www.microsoft.com/technet/security/tools/mbsahome.mspx --- MBSA
> http://scan.sygatetech.com/ --- check your firewall here [basic check]
>
> "JM_Metal" <JMMetal@discussions.microsoft.com> wrote in message
> news:FFE8407F-4CFD-4E15-838E-65F2F1551157@microsoft.com...
> > Hi All,
> >
> > We have a W2K3 server getting hit with login attempts to acounts that do
> > not
> > exist (ex: admin) on the server (brute force DOS attempts maybe). I can
> > deny
> > access when I see the IP address of the offender, but performance is
> > degrading during the attack. Is there a util that will report via e-mail
> > or
> > pager when an login attempt hits a pre-defined threshold, or shut them out
> > immediatly?
> >
> > I have policies in place to limit failed login attempts for legit
> > accounts.
> > I could not find any native windows functions for this. Any help is
> > greatly
> > apprciated.
> >
> > Thanks,
> > Jeff
> >
>
>
>
- Previous message: Roger Abell: "Re: migrate win2000 to win2003 (.vbd)"
- In reply to: Steven L Umbach: "Re: Failed Login Attempts-Non Existent Accounts"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
