Re: Multiple Logon Failure/Success Audits

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 11/29/05 

Date: Tue, 29 Nov 2005 01:40:22 -0600

It is not unusual to see multiple logon failures recorded for a single
failed logon attempt and these failures would have the same approximate
timestamp. If you are seeing a lot of logon failures at different times and
days then someone may be trying to access your computer and your best
defense is to use a very strong user password or smart card for any account
that is allowed to access the computer remotely. If you can configure your
firewall to allow remote access attempts only from authorized IP addresses
that can increase security but may not be possible if the users that need
access do not have a static public IP address or roam from place to place.
L2tp can also increase security because it requires that both computer
[first] and user authenticate to the VPN connection ideally with
certificates. --- Steve

"WhoC@nItbN0W" <WhoCnItbN0W@discussions.microsoft.com> wrote in message
news:8210D1BC-C05C-4A3F-AD24-E2B69C292C0C@microsoft.com...
> Hi:
>
> 1. While trying to login remotely to my XP machine (say XP1), I noticed
> multiple 'failure audits' from this machine (XP2). I did login
> incorrectly
> once and that was a valid entry to be seen in the logs of XP1. However,
> there
> were multiple such entries of which I am clueless about.
> Any help is appreciated.

Relevant Pages

  • Re: Automatically user lockout - big problem
    ... I would turn on Audit Logging for logon failures in the Local Security ... Then I would examine the Security event log and watch for the ... but they are sure that they are using the right passwords. ...
    (microsoft.public.windows.server.security)
  • Services loose memory of logon information
    ... applications which perform remoting database tasks to maintain security. ... The other bad part about this, is that logon failures ...
    (microsoft.public.windows.server.general)