Can you track failed login attempts?

[PlatinumGold]

i'm checking event viewer and it's loggin all failed login attempts. i got someone that keeps trying to login. what is the best way to get the IP address they are trying to logon from?

 

[Woodie]

What kind of device, what OS and are they on your private LAN, or are you allowing connections from the Internet?

 

[PlatinumGold]

Win2000 Server, they are connecting to the server via Terminal Services.

 

[watts3000]

Yes you can I think it it is in system auditing.

 

[PlatinumGold]

watts

i'm already auditing. what i want to know is if i can trace the failed login attempt to their IP address.

 

[stash]

Auditing won't show the IP address, but it should show the netbios name of the workstation that they are on at the bottom of the event data (when you double click on an event).

Logon Failure:
Reason: Unknown user name or bad password
User Name: username
Domain: DOMAIN
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: WORKSTATION

 

[PlatinumGold]

stash

i think its from outside. the ip address shows up as 127.0.0.0

 

[Tal]

Wait. 127.0.0.1 is localhost right? -TAL

 

[Woodie]

Check your scheduled jobs...see if one of them is failing. I assume it tells you what ID is failing? Is there a timing pattern? Is there a service that is supposed to be running that isn't?

 

[PlatinumGold]

TAL

yes. it is local host and yes ur right it was 127.0.0.1

BUT, all attempts to login via TERMINAL SERVICES gets logged as from IP address 127.0.0.1

so, it also shows username: xxxxxx

here's the thing. someone is trying to logon to terminal services using a specific username. now that user doesn't have administrative privileges, is reasonably limited, BUT i still don't want them logging on. i'm sure it's a former employee or someone that knows a former employee.

what i'm looking for is some kind of utility that will allow me to trace these attempts to logon.

 

[Woodie]

I understand, and it "kinda" makes sense. The real question is, how do I log all IPs that connect to my server on port 3389 (or whatever TS is on).

I would suggest a network sniffer, or a firewall with full logging. You might be able to get something with the Windows NetMon utility, but the bottom line is that you're going to have to watch the network for period of time, and go through each entry that shows the server connection attempts on the TS port.

 

[PlatinumGold]

can you recommend a good network sniffer??

 

[Woodie]

No. Depending on what hardware/network config you have, there are freeware *nix based ones, some non-free Windows based ones (not many though) and of course the professional ones (big $$, big performance). Talk to you network folks.

To do the searching/filtering, you have the target IP address (the TS server) and the port, so it shouldn't be too hard, once you get the data. Make sure that the clocks on the sniffer and the server are in sync!!! (before you start!)