Avatar of clarkcomp091501
clarkcomp091501
 asked on

The system detected a possible attempt to compromise security

I receive the following error message on the computers that are connected to the SBS Server about once a day.  Any ideas what this might be?

"S:\ is not accessible.

The system detected a possible attempt to compromise security.  Please ensure that you can contact the server that authenticated you."

This will disconnect all of the network drives and printers.  Then if I wait about 4-5 minutes everything will come back and work fine.  All of the client computers are using MSE for AV.
SBSWindows XPWindows 7

Avatar of undefined
Last Comment
LeeTutor

8/22/2022 - Mon
Darren S

Looks like something is trying to look at an S drive.  Do you have anything running that is pointing to an S drive?

Worth looking in msconfig maybe or looking for anything odd in task manager.
clarkcomp091501

ASKER
We have a network program that runs off of the s:\ drive.

I've looked in both msconfig as well as task manager. Nothing I could see out of the ordinary.
Darren S

sounds like your network is dropping.  is this a big network? If you are getting this on multiple pc's that are connected to multiple switches then I would look at the server, otherwise have a look at your switches to diagnose.

The error on the s drive is just stating that the connection has been lost as it probably failed the keep alive check
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
clarkcomp091501

ASKER
It's is a smaller network. 1 server, 2 network printers and 5 workstations.
ASKER CERTIFIED SOLUTION
Darren S

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
WORKS2011

What program do you have running on the S: drive? is there a workstation running without enough admin rights to access?

A program that comes to mind is TimeSlips, which needs access to the server from all workstations via the same drive letter, if not it causes problems like this. Are you certain all the drives mapped to the server for the program mentioned above are using the letter S to connect to the data? You could have a workstation connecting to the folder using a different drive letter that me be causing the issues you're seeing.

If this is the case make a logon script to make sure if mapped drives get disconnected they are not joined again using a different letter, for example the Z: drive. Make the logon script delete / disconnect any incorrect drives and remap using S drive letter.
WORKS2011

Another program that can cause problems if using a shared database from workstations to the server is QuickBooks, are you using this software? If so check the drive mappings and installation / configuration on each workstation running the program.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Tony Giangreco

This problem occurs because the network firewall filters Kerberos traffic.

Here is alink describing the situation and resolution
http://support.microsoft.com/kb/938457
Tony Giangreco

Have you made any progress?
LeeTutor

I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck