Solved

Event ID: 529 Security Failure Audit

Posted on 2011-09-06
4
606 Views
Last Modified: 2012-05-12
Hi

I administer a server that has recently begun to run very slowly, at times almost stopping altogether and requiring a reboot.

Several weeks ago our ISP locked us out because we were sending spam. I believe that I've dealt with that problem but the slow down persists.

The audit log was clear for several days then suddenly started to be littered with failures ID 529. I changed the Admin password to an obscure 20 random character one which seemed to help but this has begun again. For example

Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      1
       Domain:            ***************
       Logon Type:      10
       Logon Process:      User32  
       Authentication Package:      Negotiate
       Workstation Name:      *****-SBS2K3
       Caller User Name:      *****-SBS2K3$
       Caller Domain:      ***************
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID:      10432
       Transited Services:      -
       Source Network Address:      193.213.31.96
       Source Port:      63609

I've run a netsta -ano and the result is below but I'm not sure how to interpret it.

 netstat -ano result
The local address of the server is 192.168.16.1
Outside address is 62.49.88.84
My IP is 81.174.141.3

There are several IPs listed in the report that are unknown eg: 193.213.31.96:53822 showing Established. Am I correct in thinking that the Failure listed above from the same IP address port 63609 has connected successfully on port 53822?

If this is the case can someone give me some suggestion how to deal with the problem?

Thanks in advance

GHB
0
Comment
Question by:Gordon710
4 Comments
 
LVL 13

Accepted Solution

by:
connectex earned 500 total points
ID: 36493054
It looks like someone is attempting logons via port (3389 RDP). I'd recommend you disable forwarding port 3389 or restrict it to known IP addresses, if possible. If you must have RDP access I recommend you use a VPN then use RDP or consider another method of connecting to the server. It's not uncommon to see this when RDP is internet accessible.

-Matt-
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 36902192
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0
 

Author Comment

by:Gordon710
ID: 36717416
Sorry for the delay in closing I've been away.
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Available cert SBS2008 for L2TP /IPSec 4 32
Account Lockouts 25 151
Windows Server File/Folder permissions 6 72
How to restore security permissions on a file server 4 42
Every computer eventually fails. When that happens, your valuable data is only as safe as your current backup.
A customer recently asked me about anti-malware and the different deployment options available for his business. Daily news about cyberattacks, zero-day vulnerabilities, and companies that suffered a security breach made him wonder if the endpoint a…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

27 Experts available now in Live!

Get 1:1 Help Now