We help IT Professionals succeed at work.


 I have a Windows 2008 server (domain joined). As you can see in the events listed below, unknown user account 'beuser' has successfully logged in to Terminal server from IP address Network Address: using Port#      50227 with Workstation Name "ШУРА-ПК".
 Clearly this user name BEUSER does not exist in Active Directory. When I run IP Trace, It says: Continent:      Europe (EU) Country:      Latvia and we don't have any computer user living outside US.

 How is it possible for anyone to log in wit this user account?
 Is the port# 50227 is designed to accept BEUSER?

 I have Linksys Router that does NAT and port forwarding and I run Backup Exec software on the Domain Controller.

 Can you help?

An account was successfully logged on.

      Security ID:            NULL SID
      Account Name:            -
      Account Domain:            -
      Logon ID:            0x0

Logon Type:                  3

New Logon:
      Security ID:            Domain_Name\BEUser
      Account Name:            BEUser
      Account Domain:            NHECO
      Logon ID:            0x147e7e
      Logon GUID:            {00000000-0000-0000-0000-000000000000}

Process Information:
      Process ID:            0x0
      Process Name:            -

Network Information:
      Workstation Name:      ШУРА-ПК
      Source Network Address:      -
      Source Port:            -

Detailed Authentication Information:
      Logon Process:            NtLmSsp
      Authentication Package:      NTLM
      Transited Services:      -
      Package Name (NTLM only):      NTLM V2
      Key Length:            128
Network Information:
      Network Address:
      Port:                  50227
Watch Question

Distinguished Expert 2018
"Clearly this user name BEUSER does not exist in Active Directory. "

Nothing in your post "clearly" proved that this user does not exist. And in fact, the evidence posted is that this user account does exist.

My guess is that BE stands for Backup Exec and installing backup exec created the user. And either due to bugs in BE (none public that I could find) or by lax security practices in the environment, a compromise has since occurred.  

If this Latvian hacker has since had domain admin/system level access to the domain controllerl, your basically looking at a painful full domain rebuild from scratch.


My bad. BEUSER is in Active Directory.
Can I block access from IP address and shut down port number 50227?
Distinguished Expert 2018
You can, but if they already logged in and BEUser runs under the system context (not uncommon for backup agents to do their thing) then chances are the damage is done.  They could've opened a ton of other back doors and compromised systems given the situation.

The real question becomes why was this open in the first place.   Again, lax security posture. Or did the person already have some other access to get that port open.  Too many unknowns. This would need a full forensic investigation at this point. It isn't a small thing that has happened here.  That is a successful logon from a known bad actor with very likely elevated privileges.
btanExec Consultant
Distinguished Expert 2019
I suggest you manage the remote access closely. See example.

Have such remote access enforce 2FA authentication. E.g. RD Gateways do provide a simple mechanism for controlling authentication via two factor certificate based smartcards. Other two factor approaches need another approach at the Remote Desktop host itself e.g. YubiKey, RSA.

Using a RDP Gateway is strongly recommended. It provides a way to tightly restrict access to Remote Desktop ports while supporting remote connections through a single "Gateway" server.

If Remote Desktop is not used for system administration, remove all administrative access via RDP and only allow user accounts requiring RDP service. To control access to the systems even more, using “Restricted Groups” via Group Policy is also helpful.

Windows 7, and Windows Server 2008 also provide Network Level Authentication (NLA) by default. It is best to leave this in place, as NLA provides an extra level of authentication before a connection is established. You should only configure Remote Desktop servers to allow connections without NLA if you use Remote Desktop clients on other platforms that don't support it.

PS, ШУРА-ПК means SHURA-PC. Seems to suggest a Arabic PC. Since it is login I believe the account is like compromised using some default password etc. Change to strong passphrase.