[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Security Audit Failure

Posted on 2013-10-24
1
Medium Priority
?
468 Views
Last Modified: 2013-11-14
Hey guys,

got a client who's getting a lot of these. I've never had to deal with these before. There seems to be two audits which keep failing over and over. I'm more concerned with the first one. Am I right in saying that it looks like someone's trying to hack the system? And if so, is there something I can do?

It's an SBS 2008 box.

Actually, now that I think about it. the second error is from a laptop which is on the network but isn't connected to the domain. he connects his Outlook to exchange.

Thanks

-----------------
An account failed to log on.

Subject:
      Security ID:            SYSTEM
      Account Name:            SERVER$
      Account Domain:            DOMAIN
      Logon ID:            0x3e7

Logon Type:                  10

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            administrator
      Account Domain:            SERVER

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xc000006d
      Sub Status:            0xc0000064

Process Information:
      Caller Process ID:      0x2ec4
      Caller Process Name:      C:\Windows\System32\winlogon.exe

Network Information:
      Workstation Name:      SERVER
      Source Network Address:      221.204.230.57
      Source Port:            2244

Detailed Authentication Information:
      Logon Process:            User32
      Authentication Package:      Negotiate
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

-----------------
An account failed to log on.

Subject:
      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            RICHARD
      Account Domain:            RICHARD-PC

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xc000006d
      Sub Status:            0xc000006a

Process Information:
      Caller Process ID:      0x0
      Caller Process Name:      -

Network Information:
      Workstation Name:      RICHARD-PC
      Source Network Address:      192.168.0.42
      Source Port:            54667

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0
0
Comment
Question by:Talds_Alouds
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 44

Accepted Solution

by:
Davis McCarn earned 2000 total points
ID: 39600090
221.204.230.57 is owned by China Telecom and; almost without a doubt, someone is trying to hack into your server.  If you want to start doing something about it get Tweaking.com's Block Ip tool ( http://www.tweaking.com/content/page/remote_desktop_ip_monitor_blocker.html ) and IPNetInfo ( http://www.nirsoft.net/utils/ipnetinfo.html ).  When you get a rash of the failed logins; use the Block IP tool to stop them, IPNetInfo to find the entire range, and learn how to edit the blocked ip's so they cover the entire range.  It will take some time; but, you'll soon have most of the hackers blocked.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The problem of the system drive in SBS 2003 getting full continues to be an issue, even though SBS 2008 and SBS 2011 are both in the market place.  There are several solutions to this, including adding additional drive space or using third party uti…
I've often see, or have been asked, the question about the difference between the Exchange 2010 SP1 version, available as part of Small Business Server (SBS) 2011, and the “normal” Exchange 2010 SP1 Standard. The answer to the question is relativ…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question