Multiple Unauthorised logon attempts

The Event Viewer on our SBS2003 server (also runs the MSexchange) has shown two instances of logging multiple 529 errors as below.

There are multiple entries logged in succession over approx ten minutes. The messages are all as below except the username entry are random (eg , null, admin, 1234, bevis, shannon,soccer,etc)

During one apparent attack I disconnected the company broadband and they stopped instantly, so it apparently looks as though this is coming from outside the network.

Can anybody advise on how we should trace and deal with this situation please?

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            30/01/2008
Time:            04:14:55
User:            NT AUTHORITY\SYSTEM
Computer:      SEMA01
Description:
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      shannon
       Domain:            
       Logon Type:      3
       Logon Process:      Advapi  
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      Severname
       Caller User Name:      servername$
       Caller Domain:      SEMA
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID:      2712
       Transited Services:      -
       Source Network Address:      -
       Source Port:      -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Start Free Trial