Solved

Audit Failure and Account Lockouts - Active Directory

Posted on 2014-10-03
2
451 Views
Last Modified: 2014-10-04
I have a SBS 2011 Server and currently issues with account lockouts and Audit failures. All users use Exchange Active Synch, RWW and OWA. The login attempt originating externally and I have trouble resolving the issue. I have attempted to block the external IP address in the firewall but does not seem to make a difference. Any help is very much appreciated. Below the audit failure details.
Security ID:            SYSTEM
      Account Name:            TLWSVR$
      Account Domain:            TLW
      Logon ID:            0x3e7

Logon Type:                  8

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            sue
      Account Domain:            tlw

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xc000006d
      Sub Status:            0xc000006a

Process Information:
      Caller Process ID:      0x23c8
      Caller Process Name:      C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
      Workstation Name:      TLWSVR
      Source Network Address:      101.168.213.75
      Source Port:            15060

Detailed Authentication Information:
      Logon Process:            Advapi  
      Authentication Package:      Negotiate
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0
0
Comment
Question by:co_ol
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
Comment Utility
My instinct would be that the user has entered their password somewhere - mobile device most likely. The password has then been changed on the account but the device hasn't been updated.

If it happening to multiple users, then someone is doing an authentication attack. The address belongs to the Australian ISP Telstra. I presume it isn't your address?

You could use IP address restrictions on IIS to block that address if it is constantly the same address.

Simon.
0
 

Author Comment

by:co_ol
Comment Utility
I was unable to determine who that ip address belongs to but was able to block that ip address. Unless someone complains about unable to access the server i assume it is an unauthorized access. Thanks
0

Featured Post

Free book by J.Peter Bruzzese, Microsoft MVP

Are you using Office 365? Trying to set up email signatures but you’re struggling with transport rules and connectors? Let renowned Microsoft MVP J.Peter Bruzzese show you how in this exclusive e-book on Office 365 email signatures. Better yet, it’s free!

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now