Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Critical Errors In Security Log

Posted on 2011-03-14
8
Medium Priority
?
357 Views
Last Modified: 2012-05-11
We are running SBS 2003 Premium with ISA 2004. Everyday i get this log and it always has errors. My question is the Logon Failures. There are several thousand and I would like to know if I should be concerned that someone is trying to hack into our system. I have attached a screen shot of the log error Logon.docx
0
Comment
Question by:csk2512
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 12

Expert Comment

by:jmlamb
ID: 35136220
I would be concerned if anyone was trying repeated attempts to logon to the Administrator account and was failing. Even more so because the source IP address appears to be external to your network. Are you port forwarding all traffic to your SBS server, or have no firewall in between it and your ISP equipment?
0
 

Author Comment

by:csk2512
ID: 35165349
Not sure I understand. We do not have a hardware Firewall, but we are using ISA Server. Also, how can I check if we are port forwarding all trafiic to our SBS server?
0
 
LVL 12

Expert Comment

by:jmlamb
ID: 35169779
Unfortunately I'm not familiar with ISA server. I'll ask a Mod to add that zone for you to get some extra exposure.
0
Q2 2017 - Latest Malware & Internet Attacks

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out our latest Quarterly Internet Security Report!

 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 35170512
How many failed entries are there per day in the log?
Check your external router - that will tell you what traffic is being forwarded to ISA.
0
 

Author Comment

by:csk2512
ID: 35179900
I only have a DSL Modem. Is that considered an external router? The number of failed entries per day varies, but it is usually either a few hundred or up to 1000.
0
 
LVL 2

Accepted Solution

by:
ghemstrom earned 2000 total points
ID: 35180055
What you see when it comes to logon attempts is probably what any internet connection would experience:

1. Change your administrator user name into something less ordinary than administrator. That would double the security of logons.

2. See to that you have a password of maximum security level for this administrator user.

Is the domain name correct, i. e. the domain name of your domain - then you have to check whether you have a client who make unsuccessful attempts to log in.

A router ( < $ 150 ) between the modem and your network would effectively block all these attempts from your computer. And you get a lot less to administrate.

If you have clients login on to the network from outside then an installation of a VPN would be appropriate but that is beyond the scope of this discussion. (VPN = virtual private network  using encrypted communication between your network and clients)

0
 
LVL 27

Expert Comment

by:Tolomir
ID: 36283900
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question