Help: Event ID: 627

[Guest]

Hello'
I have a Windows 2003 server with RADIUS services provided by IAS. The RADIUS services are used by Wireless users & Dial-up users.
In my security log i noticed several unusual Event id 627 failure audits.

There were several failed change password attempts on the IUSR account, the IWAM account & even more suspicious on the Administrator account, & the Guest account.
Are these signs that someone is attempting to modify the local accounts on the Server? How can i detect the source of these attempts?
Examples of failed audits below

Many thanks
Blue

5/24/200
12:00:06 P
Change Password Attempt
Target Account Name: Administrato
Target Domain: SERVERNAM
Target Account ID: SERVERNAME\Administrato
Caller User Name: SERVERNAME
Caller Domain: STLCOPN
Caller Logon ID: (0x0,0x3E7
Privileges:

5/24/200
12:00:06 P
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_
Logon account: Gues
Source Workstation: SERVERNAM
Error Code: 0xC000007

5/24/200
12:00:06 P
Change Password Attempt
Target Account Name: IUSR_SERVERNAM
Target Domain: SERVERNAM
Target Account ID: SERVERNAME\IUSR_SERVERNAM
Caller User Name: SERVERNAME
Caller Domain: STLCOPN
Caller Logon ID: (0x0,0x3E7
Privileges:

 

[Jason Hall [MSFT]]

--------------------

From: =?Utf-8?B?Qmx1ZWhhZGVz?= <[email protected]>
Subject: Help: Event ID: 627
Date: Wed, 2 Jun 2004 11:41:06 -0700

Hello's

I have a Windows 2003 server with RADIUS services provided by IAS. The
RADIUS services are used by Wireless users & Dial-up users.
In my security log i noticed several unusual Event id 627 failure audits.

There were several failed change password attempts on the IUSR account,
the IWAM account & even more suspicious on the Administrator account, & the
Guest account.
Are these signs that someone is attempting to modify the local accounts on
the Server? How can i detect the source of these attempts?
Examples of failed audits below.

Many thanks.
Blue.---------------------

The FIRST thing you do when you install a server should be to RENAME the
Administrator account. Definitely do this

If you want to track the source of the malicious activity, run a network
sniffer (like Ethereal) to find out the source IP adress(es).
...if you take a careful look at the network trace you can figure out
exactly what they are doing


--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.