Solved

Ability to log FAILED logon attempts to CAS server?

Posted on 2013-06-17
4
1,468 Views
Last Modified: 2013-09-11
We are currently logging all security events from domain controllers as well as IIS/Advanced IIS logs on our CAS servers.  We wish to detect brute force attacks on OWA as well as trace back failed logon attmpts to our CAS servers.

In other words, we are looking for our CAS servers to log something along the lines of "This IP connected to this CAS server and attempted to authenticate JDOE unsuccessfully"

Right now I can see CAS activity, I see a particular user with multiple devices (Mac running Outlook, iPhone, another iPhone, and a web client running Firefox on Win 7) and we are able to see failed logon attempts for the user account between the CAS server and the Domain Controller.  What we CANNOT see is which device is generating the failed logons.
0
Comment
Question by:LNKDLNY2
  • 2
4 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39254886
You need to query the IIS logs - they should contain that information. If they don't by default, then you can adjust the logging levels to include it. Then just find something that will query those logs to give you the information that you need.

Simon.
0
 

Author Comment

by:LNKDLNY2
ID: 39254958
Thanks Simon.  Yes, we are collecting the IIS logs but I think I need to play with the logging level.  I will look into that tomorrow and update this thread with my findings for others that may run into this problem.

As it is now, the advanced IIS logging is indeed capturing source IP for connections but there is no indicator whether an authentication failed or not.
0
 
LVL 3

Expert Comment

by:zackmccracken
ID: 39257814
i dont know if you are able to combine the security events and the iis logs based on timestamp? should give you an ip address + username
0
 

Author Comment

by:LNKDLNY2
ID: 39269692
Our problem with simply correlating with security logs is that sometimes any given user may have multiple devices configured for activesync and we can see the failed sec logs but can only correlate to maybe 2 or 3 devices that are active at that time which is not sufficient.  

I think grabbing the 401 logs from the IIS service might be what I need.  For some reason our CAS servers have advanced logging but not standard logging turned on.  I am going to test that out and see what I can collect.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Server timing 4 19
outlook 6 38
EXCHANGE. LINUX, SYMANTEC MESSAGING GATEWAY 2 15
WMI - Issue Server 2012 R2 1 7
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question