We have 2 NT4 servers with public IP addresses and no firewall.
Someone is trying to crack accounts on these servers. We can see lots of failure messages in the security event logs. They are always from a different domain, different username, different password but with the same logon type = 3 (Network) and logon process = KSecDD (Security Device Driver). What does it mean ? How could we stop these cracking attempts ?
We plan to install a firewall but we would like to find a solution before it.
TIA for any information.