RSA Admin

High number of failed logon from a user-id by windows servers.

Discussion created by RSA Admin Employee on Sep 26, 2008
Latest reply on Sep 29, 2008 by RSA Admin

Hello,

 

While analysing reports relevant to faild logon from user-id in the window plateform, we get a high number of failed logon attempts from user-id finished by $ sign (5980 attempts in hour basis), these user-ids does not represnt a valid user-id, do you have any explication for this kind of events.

 

I have another question related TACACs server, i add two Tacacs servers to be monitored by envision, the first one, i get events and reports correctly, while for the other server, i receive relevant events in the didacetd ftp directory but i can't found this server in the managed devices, i did not find any relevant events for this server in reports.

 

Thanks for your help,

Mounis KHATIB 

Outcomes