Security Basics mailing list archives
How can I track this down?
From: "Nick Duda" <nduda () VistaPrint com>
Date: Thu, 1 Jun 2006 13:21:22 -0400
I'm getting a ton of these in my Security log on my DC. The logon account changes every so often, but its always a name that doesn't exist (as in we don't have a user account called 009096bb65cd) the from Workstation always says CISCO. I can't find anything in the logs that point me to an IP address. Running utils like nestat don't do much because there are already so many normal connections related to it being a DC. Any ideas? The logon to account: 009096bb65cd by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: CISCO failed. The error code was: 3221225572 Regards, Nick --------------------- Confidentiality note The information in this email and any attachment may contain confidential and proprietary information of VistaPrint and/or its affiliates and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you are hereby notified that any review, reliance or distribution by others or forwarding without express permission is strictly prohibited and may cause liability. In case you have received this message due to an error in transmission, please notify the sender immediately and to delete this email and any attachment from your system. ---------------------
Current thread:
- How can I track this down? Nick Duda (Jun 01)
- RE: How can I track this down? Roger A. Grimes (Jun 01)
- Re: How can I track this down? ilaiy (Jun 01)
- InfoSec Importance Mohamad Mneimneh (Jun 02)
- RE: InfoSec Importance Andrew Chong (Jun 02)
- RE: InfoSec Importance David Gillett (Jun 02)
- Re: InfoSec Importance Nick Owen (Jun 02)
- Re: InfoSec Importance Chris Dalton (Jun 05)
- Re: How can I track this down? ilaiy (Jun 01)
- RE: InfoSec Importance SS (Jun 02)
- Re: InfoSec Importance infosecadmin (Jun 05)
- RE: How can I track this down? Roger A. Grimes (Jun 01)