Event 4653 Windows 2008 what it means?

try allowing  port 50 and 51 for TCP IPSec stuff and Port 500 UDP and TCP for IKE

do you have newest service pack running on server

Harel66
   Why you want to open port 50 and 51 for TCP IPSec stuff and Port 500 UDP and TCP for IKE
   What is for? Or what is the trouble with that Event 4653? Open that ports benefit us in something? Remember we want to avoid an attacker enter if exist of course. All we are using are running excellent just we check Event logs regularly for security reasons.

Fredbear891:
   In properties Say Service Pack 2 constantly we are up to date with Windows Server update feature. I don´t know if Service pack is the latest.

   Now the question like before that Event what it means? Is a hacking attempt? or? In case of hacking attempts open more ports does not expose the system? We don´t have trouble in run something just were events there and we want to figure what they mean or if there is a risk of something more.
Thank you

Hate to admit it. but I don't really know. I read it on a support page it had to do with the ipsec error, and it seemed to have worked when I used it. I'll try and find the blog I found the solution on and link it; if I can find the article.

Check this out...

http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/9a5ea3fc-96f5-492f-9acd-0f865c4ae6e5/

That link shows 4625 in that error we know what it means but 4653 is the same type of error? is in common with 4625 the 4653? Because we check the logs from 4625 and 4653 and are at different hour.
Thank you

Will be better to know what is causing the error or where are the origin to know what to do because the error 4653 like I said before not show IP is another thing bu there are so many errors more than 2000 in the same error for the same Event. Now about 4625 we have solved but the question is how to deal and know the origin of 4653 are needed to see any other events or parts inside windows to identify?
Thank you

Sometimes you won't ever find out what it actually is, you just have to take steps to stop it.  If your server is being targeted on IPSec ports you should take steps to block that traffic at your firewall if the traffic isn't legitimate.

The first question I'd ask is why can traffic from the internet get to my server directly on those ports anyway?  It sounds to me like you have a lot of ports open to your server!?

Ok I understand what ports you suggest me to close for IPSEC?
Thank you

UDP and TCP ports 500 and 4500.  Also see if you can close the ESP protocol if your router allows that.

There may just be an option for IPSec forwarding.  Disable it if there is one.

Wow amazing answer is what we needed just to know we use Windows 2008 Server and we use RDP regular connection only we changed from the default port 3389 to another. We don´t use another thing to enter. Where can I disable or enable VPN in case the system has activated that and disabling VPN deosn´t affect to RDP?
Thank you

We are testing snort but we see is a command prompt command could you tell us what is the command to monitor  that section of IPsec you say or create the rule to do that?
   Or how can we disable IPsec on the server totally?
Thank you

I agree with craigbeck that a firewall is a must have first step.  However shutting off services you don't need should not be overlooked; it's called hardening your server.  The reason is the firewall serves two main purposes (besides gateway to Internet or other network).  1) It blocks traffic that the admin says shouldn't be allowed and allows traffic that should be allowed.  This only matters though if there is a service to connect to.  It's job is a moot point if only necessary services on all servers are running and nothing else.  2) It stops packets from eating up resources on other devices whose primary purpose is not to block unwanted traffic.  This one can't be accomplished by a server with a service turned off.  While that traffic won't be able to do anything malicious, you could potentially see a DoS attack because the server still has to process that bogus request.

there is only one real caveat to those rules though.  If traffic should be allowed but depending upon who is requesting (SMB file services is a good example).  If that service has been deemed necessary, chances are it is only needed from a select few.  In this case a firewall of some sort is required and this is what craigbeck is getting at when you look at those 2 rules and the caveat together.  The firewall provides the best solution for any network protection.

As for having an IDS, this was only brought up to use IF you need IPSec services to be on and used.  Just monitoring the event logs for failures is ok, but as has already been pointed out, it doesn't give very good information; you need to know the "who".  IDS's are not just to see if "something is not right", it is for when something you need to run is being misused.  So if IPSec was needed to be ran, then an IDS is perfect.  The reason is that while the event logs will tell you when there is IKE negotiation failures, it would take a lot of manual effort to correlate the information to see if there is actually a problem or not or just something that was normal.  The IDS is capable of watching all of it and alert ONLY when the threshold of bad was seen; no manual work (other than creating the signature).

That said, can you explain your infrastructure a little more.  Is the Win2k8 box running RRAS and the gateway to the internet?  I am doubting it though.  What is your gateway device to the Internet?  And is it capable of running as a firewall?  If so, just apply an ACL to it that allows port 3389/tcp inbound to the public IP of the server you're trying to RDP into.  It will automatically block any another traffic (implicit deny mechanism).

ok I see that about the 4625 is not solved but we have under control like you say we lock the IP showed in the EventID each time try to hammer the attacker. In EventID 4653 we can't do nothing until now because the EventID does not give us IP of the attacker like you see in the first msg I placed is for that we don't know where to block something.
  Now time ago (more than a year) some people of support opened in the firewall passive ports for FTP using a technique similar to this:

http://help.dotnetpanel.com/HOW-TO/Enabling%20MS%20FTP%20Passive%20Mode.aspx

   Now the thing is for some reason they opened from 5001-8500 ports passive looking  the firewall I think there are so many ports open for passive. Do you think that ports must be closed? Or is no matter that ports?   We use for passive no more than 7 ports but not thousand.
Thank you

what kind of firewall are you using?  depending on the type of firewall you have you may be able to close those and then just configure the firewall to "inspect" the ftp traffic to open the needed ports on demand.

Look the server is only with remote access. We don't have installed RRAS. We only have the default Windows Firewall of Windows 2008. We use the server to host webages and LMS system. Sound interesting to block all you say except RDP but is possible to do with our configuration? Of course the 3389 default port we changed 3 months ago to another; anyway the attaker sniffed the new port, to sniff the new port took to the attacker 3 days but they found because all was quiet duirng 3 days. Anyway if possible block all access to login to the server only to the new port of the RDP like you say will be nice just considering we use red5 for video, and host webpages, we use sql server if that block you say is possible not block the functions I mention is ok. But will be nice to block only to access inside windows all the rest except the functions I said then is ok, if the server to login can be made only locally in front of the computer with keyboard and the new port of RDP norhing more the rest of the weblages must run ok can we do how?. And if there is a way to stop the attacker sniff the new port of course we can change again but any way to make to avoid the sniffing plus block all logins except RDP new port.
Thank you we see is more complex than ww thought

Ok, is this server a domain controller?

Yes we have 10 www domains hosted there.

But is it actually an Active Directory domain controller, or just hosting websites?

We host with IIs 7.0 with Bindings option and the rest. The DNS, MX, ec. are located and configured by the host we are paying we can't modify the DNS, or MX. T add a new domain we need to tell to them to modify the DNS to store the domain, then is when we can configure witih binding in IIS the domain.
Thank you

Ok so it's just running IIS then.

So just turn on the firewall, allow the web and FTP ports and block everything else.
If you need to allow remote access to the server use something like LogMeIn.

One thing we use like smtp server to send emails in port 25, SQL. I suppose that we left open right? For FTP passive we leave the 5001-8500 range?
Thank you for the help we are almost at the point to control more; LogMeIn is an excellent idea.
Thank you

You only need passive FTP if your clients are accessing the FTP server through NAT.

You wouldn't need SQL open to internet clients.

what is your firewall though?  most intelligent firewalls these days can do basic protocol inspection so you may not need to keep those ftp passive ports open.  based on protocol inspection, the firewall would be able to dynamically open those ports when needed.  Of course if your firewall isn't capable of protocol inspection, then yes, you'd need to keep those open like you currently do.

cyclops3590 We have only the default firewall of Windows 2008 we don´t know if have that function you are saying we´ll try to look.
craigbeck Remember we only opened the ports with:
http://help.dotnetpanel.com/HOW-TO/Enabling%20MS%20FTP%20Passive%20Mode.aspx
   Only made that we don´t know if required something more, we have open the 5001-8500 ports in the firewall of Windows 2008.
   For now we disabled everything except that range of passive ports, the red5 5080 and 1935 because we are calling outside and Web http port 80 with LogMeIn and of course we closed the remote RDP service and the first night was clean and empty without attackers. I´ll keep you updated if the bleeding stops really.
Thank you

in that case, instead of doing port-based firewall allowing. do service-based firewall allowing.  just configure the ftp service to be allowed.  then you don't have to do all those other ports.

keep in mind, allowing all of those ports really isn't a "bad" thing as most of the time they will be closed, it's just cleaner to permit the service than open a bunch of ports on the off chance they are needed.

I disabled RDP like we say and we have another event 4625. Te attacker is trying to enter from some other thing different than RDP where could be trying the attacker to enter to disable the service This is the event:

An account failed to log on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            administrator
      Account Domain:            MYCPIANO-117E35

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xc000006d
      Sub Status:            0xc0000064

Process Information:
      Caller Process ID:      0x0
      Caller Process Name:      -

Network Information:
      Workstation Name:      MYCPIANO-117E35
      Source Network Address:      221.143.46.144
      Source Port:            4860

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested

We still having issues but I think we have enough information for now to keep watching the events, any other issue we'll open another question

I think we solved the issue of the attack. I update here to maybe help another person in future because that attacks are so bad. Here is what we made:

1.-Download and monitor with process monitor during the day. Then apply a filter inside there to time of the day option according the exact time given in the Event Viewer.
2.-We found on that filter the process of the attack. They tried to enter via epmap call with svshost.exe. Was a call to a server in china via the TCP.
3.-In firewall we blocked the ports 135 TCP and UDP,4444,23979,69 UDP and with that we have 5 days without any attack 0 attempts. Of course we have rdp and default ports of windows changed.