Advertisement

04.09.2007 at 11:17AM PDT, ID: 22500129
[x]
Attachment Details

token leak?

Asked by Barnabus2006 in Microsoft Operating Systems, Windows XP Operating System, Windows 2003 Server

Tags: 540, 576

We have a Windows 2003 domain with about 85 XP SP2 workstations. One of the member servers is getting thousands of Security log entries every hour from about 6 user logons. This server is a file server with internal sharepoints, a third-party, SQL Server-based database, and works as the TrendMicro central computer. We are using the default security audit settings. The seurity log is set for 16mb and and presently only holds the last 24-36 hours of activity. We don't want to turn off security logging. How do we track down and turn off this activitiy?

The Event IDS are 538, 576, and 540.  We suspect some kind of Kerberos "token leak".  Anyone have a clue?Start Free Trial
[+][-]04.09.2007 at 12:09PM PDT, ID: 18877878

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]04.09.2007 at 12:26PM PDT, ID: 18877972

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]04.09.2007 at 01:37PM PDT, ID: 18878493

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]04.10.2007 at 06:54PM PDT, ID: 18886964

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]04.12.2007 at 06:40PM PDT, ID: 18902892

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Microsoft Operating Systems, Windows XP Operating System, Windows 2003 Server
Tags: 540, 576
Sign Up Now!
Solution Provided By: karensox
Participating Experts: 4
Solution Grade: A
 
 
[+][-]04.13.2007 at 02:00PM PDT, ID: 18908496

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]04.13.2007 at 06:17PM PDT, ID: 18909366

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]04.14.2007 at 03:42AM PDT, ID: 18910385

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]04.14.2007 at 09:44AM PDT, ID: 18911263

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.02.2007 at 06:24AM PDT, ID: 19015517

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.02.2007 at 07:49AM PDT, ID: 19016307

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32