Solved

Critical Errors In Security Log

Posted on 2011-03-14
8
348 Views
Last Modified: 2012-05-11
We are running SBS 2003 Premium with ISA 2004. Everyday i get this log and it always has errors. My question is the Logon Failures. There are several thousand and I would like to know if I should be concerned that someone is trying to hack into our system. I have attached a screen shot of the log error Logon.docx
0
Comment
Question by:csk2512
8 Comments
 
LVL 12

Expert Comment

by:jmlamb
ID: 35136220
I would be concerned if anyone was trying repeated attempts to logon to the Administrator account and was failing. Even more so because the source IP address appears to be external to your network. Are you port forwarding all traffic to your SBS server, or have no firewall in between it and your ISP equipment?
0
 

Author Comment

by:csk2512
ID: 35165349
Not sure I understand. We do not have a hardware Firewall, but we are using ISA Server. Also, how can I check if we are port forwarding all trafiic to our SBS server?
0
 
LVL 12

Expert Comment

by:jmlamb
ID: 35169779
Unfortunately I'm not familiar with ISA server. I'll ask a Mod to add that zone for you to get some extra exposure.
0
Scale it in WD Gold

With up to ten times the workload capacity of desktop drives, WD Gold hard drives employ advanced technology to deliver among the best in reliability, capacity, power efficiency and performance.

 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 35170512
How many failed entries are there per day in the log?
Check your external router - that will tell you what traffic is being forwarded to ISA.
0
 

Author Comment

by:csk2512
ID: 35179900
I only have a DSL Modem. Is that considered an external router? The number of failed entries per day varies, but it is usually either a few hundred or up to 1000.
0
 
LVL 2

Accepted Solution

by:
ghemstrom earned 500 total points
ID: 35180055
What you see when it comes to logon attempts is probably what any internet connection would experience:

1. Change your administrator user name into something less ordinary than administrator. That would double the security of logons.

2. See to that you have a password of maximum security level for this administrator user.

Is the domain name correct, i. e. the domain name of your domain - then you have to check whether you have a client who make unsuccessful attempts to log in.

A router ( < $ 150 ) between the modem and your network would effectively block all these attempts from your computer. And you get a lot less to administrate.

If you have clients login on to the network from outside then an installation of a VPN would be appropriate but that is beyond the scope of this discussion. (VPN = virtual private network  using encrypted communication between your network and clients)

0
 
LVL 27

Expert Comment

by:Tolomir
ID: 36283900
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

New My Cloud Pro Series - organize everything!

With space to keep virtually everything, the My Cloud Pro Series offers your team the network storage to edit, save and share production files from anywhere with an internet connection. Compatible with both Mac and PC, you're able to protect your content regardless of OS.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

By this time the large percentage of day-to-day transactions have shifted to mobile banking; here are some overriding areas QAs must investigate while testing mobile banking apps.  
Find out what Office 365 Transport Rules are, how they work and their limitations managing Office 365 signatures.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
A short film showing how OnPage and Connectwise integration works.

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now