Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Worrisome error 675 event id problem showing continuous unsuccessful audits, 7 per second

Posted on 2006-11-11
6
Medium Priority
?
1,430 Views
Last Modified: 2013-12-04
Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      675
Date:            11/7/2006
Time:            1:52:31 PM
User:            NT AUTHORITY\SYSTEM
Computer:      LONGBOWFP01
Description:
Pre-authentication failed:
       User Name:            YOUR-A9279112E3$
       User ID:            LONGBOW\YOUR-A9279112E3$
       Service Name:            krbtgt/LONGBOW.INTRA
       Pre-Authentication Type:      0x2
       Failure Code:            0x18
       Client Address:            192.168.0.45
 

there are hundreds of these per day, all from this one IP address.  I'm not sure what's going on... can someone help?  Thanks.  
0
Comment
Question by:QuiteSupersonic
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 9

Expert Comment

by:trenes
ID: 17921823
Hi QuiteSupersonic,

Seems like you are under a dictionary attack.
Block the IP in the firewall.

Cheers!
regards,

Trenes
0
 

Author Comment

by:QuiteSupersonic
ID: 17921846
But i have setup an account lockout after 5 tries in group policy.  Shouldn't this prevent further attempts?  And it would seem as the requests are happening internally. After all, there is a machine with the .45 address on our network.  

Are you saying there's a program on this pc trying numerous user names and passwords to enter the system? Thanks.
0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 17927867
Doesn't stop attempts... just simply keeps them from succeeding if they did guess the password correctly.
http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1

That IP BTW looks like it's coming from inside your network as it's an RFC 1918 subnet.. the class B subnet 192.168.x.x
There are plenty of apps that can do this, and a very effective one is called TSgrinder http://www.hammerofgod.com/download.html
There are also plenty of viri that can trigger this, slammer, code-red, welcha... they scan for hosts to infect... you can find the switch port by the pc's mac address
-rich
0
Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

 

Author Comment

by:QuiteSupersonic
ID: 17927937
Unfortunately the computer's name is generic, and i'm not sure which user's workstation this is.  Is there a way to know which user name is long onto a given pc in the domain?  
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 2000 total points
ID: 17930347
nbtstat -A 192.168.0.45  (if it's not firewalled you can get the mac address) If it is firewalled, you will have to look on your router for the arp cache, on cisco you type
show arp
and look for the .45 ip's mac address, you go onto a switch and look for that mac, for 1U switches like the 2900 and 3500 series cisco's you type
show mac-address-table
and look for that same mac, for a catalyst series cisco switch like the 4000, 5000, 6500 series' you type
show cam dynamic     or   show cam ab-cd-ef-01-02-03 (that is an example mac address)
-rich
0
 
LVL 7

Expert Comment

by:SoyYop
ID: 18079228
I'm having the same problem. I identified the machine, but I haven't logged into in a LONG time.

I haven't checked in detail. However, it may be some kind of service installed... with that account into the machine, which saved the password.

Or the user has a bad bug. My account is a hidden one (with $ at the end). So, is difficult anyone gets is easy...

I'll check this thread later.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question