Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Ability to log FAILED logon attempts to CAS server?

Posted on 2013-06-17
4
Medium Priority
?
1,771 Views
Last Modified: 2013-09-11
We are currently logging all security events from domain controllers as well as IIS/Advanced IIS logs on our CAS servers.  We wish to detect brute force attacks on OWA as well as trace back failed logon attmpts to our CAS servers.

In other words, we are looking for our CAS servers to log something along the lines of "This IP connected to this CAS server and attempted to authenticate JDOE unsuccessfully"

Right now I can see CAS activity, I see a particular user with multiple devices (Mac running Outlook, iPhone, another iPhone, and a web client running Firefox on Win 7) and we are able to see failed logon attempts for the user account between the CAS server and the Domain Controller.  What we CANNOT see is which device is generating the failed logons.
0
Comment
Question by:LNKDLNY2
  • 2
4 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 1500 total points
ID: 39254886
You need to query the IIS logs - they should contain that information. If they don't by default, then you can adjust the logging levels to include it. Then just find something that will query those logs to give you the information that you need.

Simon.
0
 

Author Comment

by:LNKDLNY2
ID: 39254958
Thanks Simon.  Yes, we are collecting the IIS logs but I think I need to play with the logging level.  I will look into that tomorrow and update this thread with my findings for others that may run into this problem.

As it is now, the advanced IIS logging is indeed capturing source IP for connections but there is no indicator whether an authentication failed or not.
0
 
LVL 3

Expert Comment

by:zackmccracken
ID: 39257814
i dont know if you are able to combine the security events and the iis logs based on timestamp? should give you an ip address + username
0
 

Author Comment

by:LNKDLNY2
ID: 39269692
Our problem with simply correlating with security logs is that sometimes any given user may have multiple devices configured for activesync and we can see the failed sec logs but can only correlate to maybe 2 or 3 devices that are active at that time which is not sufficient.  

I think grabbing the 401 logs from the IIS service might be what I need.  For some reason our CAS servers have advanced logging but not standard logging turned on.  I am going to test that out and see what I can collect.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The main intent of this article is to make you aware of ‘Exchange fail to mount’ error, its effects, causes, and solution.
There can be many situations demanding the conversion of Outlook OST files to PST format and as such, there is no shortage of automated tools to perform this conversion. However, what makes Stellar OST to PST converter stand above the rest? Let us e…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question