Solved

Worrisome error 675 event id problem showing continuous unsuccessful audits, 7 per second

Posted on 2006-11-11
6
1,423 Views
Last Modified: 2013-12-04
Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      675
Date:            11/7/2006
Time:            1:52:31 PM
User:            NT AUTHORITY\SYSTEM
Computer:      LONGBOWFP01
Description:
Pre-authentication failed:
       User Name:            YOUR-A9279112E3$
       User ID:            LONGBOW\YOUR-A9279112E3$
       Service Name:            krbtgt/LONGBOW.INTRA
       Pre-Authentication Type:      0x2
       Failure Code:            0x18
       Client Address:            192.168.0.45
 

there are hundreds of these per day, all from this one IP address.  I'm not sure what's going on... can someone help?  Thanks.  
0
Comment
Question by:QuiteSupersonic
6 Comments
 
LVL 9

Expert Comment

by:trenes
ID: 17921823
Hi QuiteSupersonic,

Seems like you are under a dictionary attack.
Block the IP in the firewall.

Cheers!
regards,

Trenes
0
 

Author Comment

by:QuiteSupersonic
ID: 17921846
But i have setup an account lockout after 5 tries in group policy.  Shouldn't this prevent further attempts?  And it would seem as the requests are happening internally. After all, there is a machine with the .45 address on our network.  

Are you saying there's a program on this pc trying numerous user names and passwords to enter the system? Thanks.
0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 17927867
Doesn't stop attempts... just simply keeps them from succeeding if they did guess the password correctly.
http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1

That IP BTW looks like it's coming from inside your network as it's an RFC 1918 subnet.. the class B subnet 192.168.x.x
There are plenty of apps that can do this, and a very effective one is called TSgrinder http://www.hammerofgod.com/download.html
There are also plenty of viri that can trigger this, slammer, code-red, welcha... they scan for hosts to infect... you can find the switch port by the pc's mac address
-rich
0
Free camera licenses with purchase of My Cloud NAS

Milestone Arcus software is compatible with thousands of industry-leading cameras for added flexibility. Upon installation on your My Cloud NAS, you will receive two (2) camera licenses already enabled in the software. And for a limited time, get additional camera licenses FREE.

 

Author Comment

by:QuiteSupersonic
ID: 17927937
Unfortunately the computer's name is generic, and i'm not sure which user's workstation this is.  Is there a way to know which user name is long onto a given pc in the domain?  
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 17930347
nbtstat -A 192.168.0.45  (if it's not firewalled you can get the mac address) If it is firewalled, you will have to look on your router for the arp cache, on cisco you type
show arp
and look for the .45 ip's mac address, you go onto a switch and look for that mac, for 1U switches like the 2900 and 3500 series cisco's you type
show mac-address-table
and look for that same mac, for a catalyst series cisco switch like the 4000, 5000, 6500 series' you type
show cam dynamic     or   show cam ab-cd-ef-01-02-03 (that is an example mac address)
-rich
0
 
LVL 7

Expert Comment

by:SoyYop
ID: 18079228
I'm having the same problem. I identified the machine, but I haven't logged into in a LONG time.

I haven't checked in detail. However, it may be some kind of service installed... with that account into the machine, which saved the password.

Or the user has a bad bug. My account is a hidden one (with $ at the end). So, is difficult anyone gets is easy...

I'll check this thread later.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In today's information driven age, entrepreneurs have so many great tools and options at their disposal to help turn good ideas into a thriving business. With cloud-based online services, such as Amazon's Web Services (AWS) or Microsoft's Azure, bus…
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
In this video I am going to show you how to back up and restore Office 365 mailboxes using CodeTwo Backup for Office 365. Learn more about the tool used in this video here: http://www.codetwo.com/backup-for-office-365/ (http://www.codetwo.com/ba…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now