Solved

Ability to log FAILED logon attempts to CAS server?

Posted on 2013-06-17
4
1,430 Views
Last Modified: 2013-09-11
We are currently logging all security events from domain controllers as well as IIS/Advanced IIS logs on our CAS servers.  We wish to detect brute force attacks on OWA as well as trace back failed logon attmpts to our CAS servers.

In other words, we are looking for our CAS servers to log something along the lines of "This IP connected to this CAS server and attempted to authenticate JDOE unsuccessfully"

Right now I can see CAS activity, I see a particular user with multiple devices (Mac running Outlook, iPhone, another iPhone, and a web client running Firefox on Win 7) and we are able to see failed logon attempts for the user account between the CAS server and the Domain Controller.  What we CANNOT see is which device is generating the failed logons.
0
Comment
Question by:LNKDLNY2
  • 2
4 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39254886
You need to query the IIS logs - they should contain that information. If they don't by default, then you can adjust the logging levels to include it. Then just find something that will query those logs to give you the information that you need.

Simon.
0
 

Author Comment

by:LNKDLNY2
ID: 39254958
Thanks Simon.  Yes, we are collecting the IIS logs but I think I need to play with the logging level.  I will look into that tomorrow and update this thread with my findings for others that may run into this problem.

As it is now, the advanced IIS logging is indeed capturing source IP for connections but there is no indicator whether an authentication failed or not.
0
 
LVL 3

Expert Comment

by:zackmccracken
ID: 39257814
i dont know if you are able to combine the security events and the iis logs based on timestamp? should give you an ip address + username
0
 

Author Comment

by:LNKDLNY2
ID: 39269692
Our problem with simply correlating with security logs is that sometimes any given user may have multiple devices configured for activesync and we can see the failed sec logs but can only correlate to maybe 2 or 3 devices that are active at that time which is not sufficient.  

I think grabbing the 401 logs from the IIS service might be what I need.  For some reason our CAS servers have advanced logging but not standard logging turned on.  I am going to test that out and see what I can collect.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now