RSA Admin

High number of failed logon from a user-id by windows servers.

Discussion created by RSA Admin Employee on Sep 26, 2008
Latest reply on Sep 29, 2008 by RSA Admin



While analysing reports relevant to faild logon from user-id in the window plateform, we get a high number of failed logon attempts from user-id finished by $ sign (5980 attempts in hour basis), these user-ids does not represnt a valid user-id, do you have any explication for this kind of events.


I have another question related TACACs server, i add two Tacacs servers to be monitored by envision, the first one, i get events and reports correctly, while for the other server, i receive relevant events in the didacetd ftp directory but i can't found this server in the managed devices, i did not find any relevant events for this server in reports.


Thanks for your help,

Mounis KHATIB