How do I stop an intruder from bouncing around my network like it was a ping pong game? I have ISA and SBS server 2003. I thought it was protected from these kinds of multiple attempts. Ive gone thru my logs and there are THOUSANDS of these attempts to gain access. The latest it seems to be from the source of an internal machine on the network but this is not the case. I scanned the particular machine for spyware and nothing. It doesnt seem to matter because if I turn off the machine he comes from and that is not listed. I also blocked via ISA hundreds of thousands of IPs from China, Russia and so on but this particular intruder I cannot stop. HOW DO I FIND ANS STOP???
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 3/21/2008
Time: 11:50:20 AM
User: NT AUTHORITY\SYSTEM
Computer: MX-MAIL-SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: kaitlin
Domain: SFMX
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: OPS-MANAGER
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.1.50
Source Port: 0
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 3/21/2008
Time: 11:50:20 AM
User: NT AUTHORITY\SYSTEM
Computer: MX-MAIL-SERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain: SFMX
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Start Free Trial
