Attempted intrusion,  Event 529 in Security Logs

We are running IIS and Microsoft Exchange on this server which is mapped to a public IP address.  Used primarily for Outlook Web Access and Remote Web Workplace.  Several times a week, someone attempts to gain access on various ports.  The failed attempt logs an Event 529 in the security logs.

I have 2 questions.  First and most importantly, in the most recent attempt, the intruder used ALL valid usernames.  They went down the list of everyone in the organization.  How do they know the usernames as it is not public information? (the offending IP was from the Netherlands, so I don't think it's anyone that knows us).   Second, why doesn't the security log show the source IP address and port?  I am using a Sonciwall with ViewPoint and can get the info from there, but just curious why it doesn't show up in the server log.

I always report suspicious activity to the appropriate ISP.

The following is logged in the server security logs:

Alert on SERVER at 7/10/2008 5:36:35 AM

Event ID=529 in Security Log monitor : event received. Critical condition.
Log: Security
ID: 529
Type: Audit Failure
Source: Security
Logon Failure:

      Reason:            Unknown user name or bad password

      User Name:      stephanie

      Domain:            

      Logon Type:      3

      Logon Process:      Advapi  

      Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

      Workstation Name:      SERVER

      Caller User Name:      SERVER$

      Caller Domain:      HPCBD

      Caller Logon ID:      (0x0,0x3E7)

      Caller Process ID:      10396

      Transited Services:      -

      Source Network Address:      -

      Source Port:      -


(WMI Status: 0 )
Start Free Trial