Solved

Critical Errors In Security Log

Posted on 2011-03-14
8
354 Views
Last Modified: 2012-05-11
We are running SBS 2003 Premium with ISA 2004. Everyday i get this log and it always has errors. My question is the Logon Failures. There are several thousand and I would like to know if I should be concerned that someone is trying to hack into our system. I have attached a screen shot of the log error Logon.docx
0
Comment
Question by:csk2512
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 12

Expert Comment

by:jmlamb
ID: 35136220
I would be concerned if anyone was trying repeated attempts to logon to the Administrator account and was failing. Even more so because the source IP address appears to be external to your network. Are you port forwarding all traffic to your SBS server, or have no firewall in between it and your ISP equipment?
0
 

Author Comment

by:csk2512
ID: 35165349
Not sure I understand. We do not have a hardware Firewall, but we are using ISA Server. Also, how can I check if we are port forwarding all trafiic to our SBS server?
0
 
LVL 12

Expert Comment

by:jmlamb
ID: 35169779
Unfortunately I'm not familiar with ISA server. I'll ask a Mod to add that zone for you to get some extra exposure.
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 35170512
How many failed entries are there per day in the log?
Check your external router - that will tell you what traffic is being forwarded to ISA.
0
 

Author Comment

by:csk2512
ID: 35179900
I only have a DSL Modem. Is that considered an external router? The number of failed entries per day varies, but it is usually either a few hundred or up to 1000.
0
 
LVL 2

Accepted Solution

by:
ghemstrom earned 500 total points
ID: 35180055
What you see when it comes to logon attempts is probably what any internet connection would experience:

1. Change your administrator user name into something less ordinary than administrator. That would double the security of logons.

2. See to that you have a password of maximum security level for this administrator user.

Is the domain name correct, i. e. the domain name of your domain - then you have to check whether you have a client who make unsuccessful attempts to log in.

A router ( < $ 150 ) between the modem and your network would effectively block all these attempts from your computer. And you get a lot less to administrate.

If you have clients login on to the network from outside then an installation of a VPN would be appropriate but that is beyond the scope of this discussion. (VPN = virtual private network  using encrypted communication between your network and clients)

0
 
LVL 27

Expert Comment

by:Tolomir
ID: 36283900
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Increase Agility with Enabled Toolchains

Connect your existing build, deployment, management, monitoring, and collaboration platforms. From Puppet to Chef, HipChat to Slack, ServiceNow to JIRA, Splunk to New Relic and beyond, hand off data between systems to engage the right people.

Connect with xMatters.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Email attacks are the most common methods for initiating ransomware and phishing scams. Attackers want you to open an infected attachment or click a malicious link, and unwittingly download malware to your machine. Here are 7 ways you can stay safe.
Here's a look at newsworthy articles and community happenings during the last month.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question