ViaSat, a global provider of satellite and wireless communications, securely connects businesses, governments, and organizations to the Internet. Learn how ViaSat’s Network Solutions Engineer, drove the transition from a traditional network support to a DevOps-centric model.
Course Of The Month
5 days, 22 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Security Audit Event 5152. Is this a concern?
Posted on 2013-01-01
I'm getting the attached event. Do I need to be concerned?
audit.jpg
audit.jpg
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
3
2
6 Comments
Active today
Hi,
This looks like the windows firewall hasn't set correctly for the inbound traffic. Also, it could be edge traversal settings. Have a look at this MS article and try to set edge traversal and see it stops the event.
http://technet.microsoft.com/en-us/library/ee649264(v=ws.10).aspx
This looks like the windows firewall hasn't set correctly for the inbound traffic. Also, it could be edge traversal settings. Have a look at this MS article and try to set edge traversal and see it stops the event.
http://technet.microsoft.com/en-us/library/ee649264(v=ws.10).aspx
Active today
The Windows firewall on that server is off. If it's not a concern, then I can just ignore it, correct?
Active today
Hi,
Thanks for your reply. Bur unfortunately this event required attention as it's indicates that there is a inbound packet blocked by windows filtering. It could be a attempt of hacking.
Also, the windows firewall service in question should be on in windows 2008 environment. You can also refer this tech article and install the required hotfix (the error events are same)
http://support.microsoft.com/kb/2654852
Hope this helps
Thanks for your reply. Bur unfortunately this event required attention as it's indicates that there is a inbound packet blocked by windows filtering. It could be a attempt of hacking.
Also, the windows firewall service in question should be on in windows 2008 environment. You can also refer this tech article and install the required hotfix (the error events are same)
http://support.microsoft.com/kb/2654852
Hope this helps
I tried to get WHOIS listing of 239.255.255.250 but could not find any details and the port 138 is used by NetBIOS protocol used for File and Print Sharing under all current versions of Windows.
As this public IP is not from valid source it may be attempt of attack so would recommend you to check impact by blocking this IP on your external firewall and run full AV scan in safe mode
As this public IP is not from valid source it may be attempt of attack so would recommend you to check impact by blocking this IP on your external firewall and run full AV scan in safe mode
Featured Post
PeopleSoft Adoption Made Smooth & Simple!
On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool. Claim Your Free WalkMe Account Now
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Suggested Solutions
| Title | # Comments | Views | Activity |
|---|---|---|---|
| Unable to access folder shares on Netapp | 1 | 24 | |
| Exchange, OWA, PROXY | 7 | 65 | |
| Server 2008 R2 has no more space on C: (OS) drive | 21 | 92 | |
| [Window server 2008 SP1 build 7601 x64] The update is not applicable to your computer | 11 | 56 |
This article runs through the process of deploying a single EXE application selectively to a group of user.
A hard and fast method for reducing Active Directory Administrators members.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility.
Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Suggested Courses
Course of the Month5 days, 22 hours left to enroll
734 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.