Security Help 2003 please

Black Hat · 9 Jul 2009 at 09:20

Hi all,

Fairly new to Server 2003 but i keep getting this problem whereby my user account gets locked out overnight i can only assume its a collegue or an attack of somkind on our server, we are using remote desktop and without dissrupting everyone else is there anyway to increase security on the server/stop this from happening. I have checked the logs and all it says is ANNONOMOUS LOGON and under the categorie it says Logon/Logoff. If a collegue or myself logs on it has our username so i can only assume its a hack attempt or something similar.

Cheers

BH

Black Hat · 13 Jul 2009 at 21:24

Anyone?

Moley · 13 Jul 2009 at 21:26

Group Policy perhaps?

Black Hat · 13 Jul 2009 at 21:29

Moley said:
Group Policy perhaps?

Got no idea how to set a group policy as i said im quite new to server 2003 and just finding my way around, will have to have another play tommorow morning.

theheyes · 13 Jul 2009 at 21:31

This is only happening with your own user account?

Black Hat · 13 Jul 2009 at 21:38

theheyes said:
This is only happening with your own user account?

yep

richardbirks · 13 Jul 2009 at 21:54

If group policy enforces password changes periodically then you could have a dead terminal services session lying around locking your account out periodically (it continues to attempt authentication using your "old" credentials).

Get someone to pull the security event logs from a domain controller on your network and get them to look for failure audits for your login, it'll tell you where the rogue logins are coming from and go from there.

--
Richard.

Black Hat · 13 Jul 2009 at 23:47

richardbirks said:
If group policy enforces password changes periodically then you could have a dead terminal services session lying around locking your account out periodically (it continues to attempt authentication using your "old" credentials).

Get someone to pull the security event logs from a domain controller on your network and get them to look for failure audits for your login, it'll tell you where the rogue logins are coming from and go from there.

--
Richard.

Cheers ive looked at all the logs and theres no failed logon atempts which is confusing.

Vertigo · 13 Jul 2009 at 23:50

Definitely sounds like some kind of scheduled event is trying to authenticate against your user account but with a blank or old password.

Any scheduled tasks set up for overnight which are trying to use your account?

theheyes · 13 Jul 2009 at 23:51

Vertigo1 said:
Any scheduled tasks set up for overnight which are trying to use your account?

A backup task, perhaps?

Black Hat · 14 Jul 2009 at 09:07

theheyes said:
A backup task, perhaps?

Not that i know of i will check see if theres any AV shedules.

Moley · 14 Jul 2009 at 10:07

If you disconnect your desktop from the network (literally pull the ethernet cable out) then reboot - can you login with cached credentials?

If so then your password on the domain is definately either being changed or locked out by something.

richardbirks · 14 Jul 2009 at 21:14

Irrespective of what's doing it, getting a helpful sys-admin to look through the security event logs on one (or several) of your domain controllers for failure audits for your account is going to be the best starting point. A server name, or IP address may well jog your memory. It could be all sorts of things locking it out, such as:

Rogue terminal service session
Scheduled task
Mapped drive
Running a service using your named account credentials
Someone who hates you and wants to boil your bunny (ok, maybe not)

--
Richard

Black Hat · 15 Jul 2009 at 14:03

richardbirks said:
Irrespective of what's doing it, getting a helpful sys-admin to look through the security event logs on one (or several) of your domain controllers for failure audits for your account is going to be the best starting point. A server name, or IP address may well jog your memory. It could be all sorts of things locking it out, such as:

Rogue terminal service session

Scheduled task

Mapped drive

Running a service using your named account credentials

Someone who hates you and wants to boil your bunny (ok, maybe not)

--
Richard

Thanks ive checked all these, the log reports no failed account logon attempts so it point towards something running trying to authenticate for now ive just turn off the account lockout polict as i dont hae time to waste figuring this out, from a quick look there absoloutly nothing left runing onmy account oh well nvm. Thanks for your all your help guys.