Solved

Ability to log FAILED logon attempts to CAS server?

Posted on 2013-06-17
4
1,397 Views
Last Modified: 2013-09-11
We are currently logging all security events from domain controllers as well as IIS/Advanced IIS logs on our CAS servers.  We wish to detect brute force attacks on OWA as well as trace back failed logon attmpts to our CAS servers.

In other words, we are looking for our CAS servers to log something along the lines of "This IP connected to this CAS server and attempted to authenticate JDOE unsuccessfully"

Right now I can see CAS activity, I see a particular user with multiple devices (Mac running Outlook, iPhone, another iPhone, and a web client running Firefox on Win 7) and we are able to see failed logon attempts for the user account between the CAS server and the Domain Controller.  What we CANNOT see is which device is generating the failed logons.
0
Comment
Question by:LNKDLNY2
  • 2
4 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39254886
You need to query the IIS logs - they should contain that information. If they don't by default, then you can adjust the logging levels to include it. Then just find something that will query those logs to give you the information that you need.

Simon.
0
 

Author Comment

by:LNKDLNY2
ID: 39254958
Thanks Simon.  Yes, we are collecting the IIS logs but I think I need to play with the logging level.  I will look into that tomorrow and update this thread with my findings for others that may run into this problem.

As it is now, the advanced IIS logging is indeed capturing source IP for connections but there is no indicator whether an authentication failed or not.
0
 
LVL 3

Expert Comment

by:zackmccracken
ID: 39257814
i dont know if you are able to combine the security events and the iis logs based on timestamp? should give you an ip address + username
0
 

Author Comment

by:LNKDLNY2
ID: 39269692
Our problem with simply correlating with security logs is that sometimes any given user may have multiple devices configured for activesync and we can see the failed sec logs but can only correlate to maybe 2 or 3 devices that are active at that time which is not sufficient.  

I think grabbing the 401 logs from the IIS service might be what I need.  For some reason our CAS servers have advanced logging but not standard logging turned on.  I am going to test that out and see what I can collect.
0

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Binding MAC To Active Directory Domain 1 26
Exchange Mailbox 2 38
Custom attributes in Exchange 8 40
active directory 17 36
We are happy to announce a brand new addition to our line of acclaimed email signature management products – CodeTwo Email Signatures for Office 365.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
how to add IIS SMTP to handle application/Scanner relays into office 365.

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now