Registered users    
MembershipMembership:
Latest New UserLatest:lovely raaaa
New TodayNew Today:9
New YesterdayNew Yesterday:13
User CountOverall:22448
Private messaging    
You must be logged in to use this module.
Top 10 posters    
NamePosts
Mariette Knap12480
Marina Roos11431
Eriq Neale2069
Michael Patrick1879
Stan Guinn1779
Robert Pearman1704
Nick Pieters1425
Stewart Brown607
Eddie Kerr534
Kevin D.519
Welcome unauthorized visitor    
If you want to join us in the discussions on this forum you need to register first. Registration is free! If you are already a registered user please login to join the forum.
Small Business Server Support Forum    
Forums > Microsoft Smallbusiness Server > Small Business Server 2003
Subject: Dictionary Attack, logon type 3
Prev Next
You are not authorized to post a reply.

Author Messages
Sherry Bemis User is Offline
United States
Member since
3/13/2006

Registered Users
Posts: 43
3/26/2008 08:47 PM  
Am receiving multiple logon attempts with bad user names.  Are these from the RWW page?  Is there a way I can log the IP address using ISA 2004 and block it in the future?
Kevin Da Silva User is Offline
Mississauga, Canada
Member since
1/12/2008

Registered Users
Posts: 519
3/26/2008 09:38 PM  
How often does this occur?

If your concerned I would turn on Auditing, and as for ISA monitoring if you know how often they occur you could turn on Logging and try to find out that way.
MCSE:Messaging, MCTIP, SBS Specialist
Neil Beswick User is Offline
United Kingdom
Member since
9/26/2007

Platinum Membership
Posts: 94
3/26/2008 10:26 PM  
Sherry - check out the %systemroot%\System32\LogFiles\W3SVCnnnnn folder on your SBS server - these are the IIS logs, and should show incoming HTTP(S) requests...

Neil.
Marina Roos User is Offline
The Netherlands
Member since
3/24/2005

Forum Admins
Posts: 11431
4/01/2008 02:35 AM  
Hi Sherry,
 
Most of the times those logon type 3 attacks are people trying to relay through your exchange server. If you have setup SMTP logging, you will find the attempts in that file.
Marina Roos Smallbizserver.Net AdministratorMission accomplished. We have joined the branch office to our SBS 2003 Headquarters and have the same user experience on the branch office as we have on our local  network at the Headquarters. Want to know how? Signup up for a subscription and get instant access to the article series 'How to add an additional Domain Controller from a remote office to the SBS domain'
You are not authorized to post a reply.
Forums > Microsoft Smallbusiness Server > Small Business Server 2003 > Dictionary Attack, logon type 3


ActiveForums 3.7
Forum policy    
These Discussion Forums are dedicated to the discussion of the Small Business Server and related server and client software. For the benefit of the community please observe the following posting guidelines:
  1. No Advertising. This includes promotion of commercial products and non-commercial products which are not directly related to Small Business Server and related server and client software.
  2. No Flaming or Trolling.
  3. No Profanity, Racism, or Prejudice.
  4. Site Moderators have the final word on approving/removing a thread or post or comment.
Copyright 2002-2008 Concentrix b.v.    :   Page generated in 6.0312886 seconds.   :   Terms Of Use   :   Privacy Statement