Solved

Audit Failure and Account Lockouts - Active Directory

Posted on 2014-10-03
2
469 Views
Last Modified: 2014-10-04
I have a SBS 2011 Server and currently issues with account lockouts and Audit failures. All users use Exchange Active Synch, RWW and OWA. The login attempt originating externally and I have trouble resolving the issue. I have attempted to block the external IP address in the firewall but does not seem to make a difference. Any help is very much appreciated. Below the audit failure details.
Security ID:            SYSTEM
      Account Name:            TLWSVR$
      Account Domain:            TLW
      Logon ID:            0x3e7

Logon Type:                  8

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            sue
      Account Domain:            tlw

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xc000006d
      Sub Status:            0xc000006a

Process Information:
      Caller Process ID:      0x23c8
      Caller Process Name:      C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
      Workstation Name:      TLWSVR
      Source Network Address:      101.168.213.75
      Source Port:            15060

Detailed Authentication Information:
      Logon Process:            Advapi  
      Authentication Package:      Negotiate
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0
0
Comment
Question by:co_ol
2 Comments
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 40361147
My instinct would be that the user has entered their password somewhere - mobile device most likely. The password has then been changed on the account but the device hasn't been updated.

If it happening to multiple users, then someone is doing an authentication attack. The address belongs to the Australian ISP Telstra. I presume it isn't your address?

You could use IP address restrictions on IIS to block that address if it is constantly the same address.

Simon.
0
 

Author Comment

by:co_ol
ID: 40361808
I was unable to determine who that ip address belongs to but was able to block that ip address. Unless someone complains about unable to access the server i assume it is an unauthorized access. Thanks
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question