system from domain is making many attempts to access the administr

[Guest]

Good morning.

One of my W2K server captured in the security log the following error
message before hanging up today:

A system belonging to the "X" domain many attempts to access the
administrator account.

Why this is happening? Does renaming the administrator account will avoid
this issue?

The server is using the latest antivirus releases.

Thanks a lot for your fast response,

Regards,

Juan

 

[Roger Abell [MVP]]

Any exposed system will pick these up, and with Administrator renamed the
dumber probbots hop on off elsewhere.
Exposure can be to a compromised internal machine.
In higher exposures on the open net you will find probware that exhibits
adaptability in its attemps at use of names collected in your near net, or
if you have leaked enumerabilities, it attempts only (likely and/or) key
names.
As long as you audit success to warrantee the attempts fail, a hardened
system (includes pwd quality) can travel the open net unchanged.
Getting a firewall and managing it is what you need for that W2k (assuming
the origin is not a sick internal machine). You could use IPsec if you're
tech oriented on this (or alternatively just buying an upgrade could cure a
few things, including firewall).