|
Posted by john d on February 13, 2006, 3:41 pm
Please log in for more thread options
Hi - I've got a public Windows 2000 FTP box and noticed the following failure
entry logged several times in my Security log this morning. Is it normal to
assume that because this is a public FTP machine, I will periodically see
failed audits such as this? Is there anything on the machine I should check
to ensure the machine was not compromised? I am running a desktop firewall
and have locked down security policy and ACL in place.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 2/13/2006
Time: 8:00:00 AM
User: NT AUTHORITY\SYSTEM
Computer: FTPMACHINE
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: SERVICE
Domain: NT AUTHORITY
Logon Type: 2
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: FTPMACHINE
| 
XML Sitemap