This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice / help would be greatly appreciated.
Authentication Ticket Request:
User Name: rosu
Supplied Realm Name: my domain
User ID: -
Service Name: krbtgt/my domain
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: 127.0.0.1
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Now if you notice the user, for each event like this one.. the user name changes and they seem to be all alphabetical attempts if I would sort by date.. The IP here is internal on this one, but for most it is an outside IP such as 213.88.247.2 .. It seems the source port on the event changes as well. Take a look at another:
Logon Failure:
Reason: Unknown user name or bad password
User Name: rout
Domain: my Domain
Logon Type: 10
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: my Server Hostname
Caller User Name: my Server Hostname$
Caller Domain: my Domain
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 7576
Transited Services: -
Source Network Address: 213.88.247.2
Source Port: 3030
Hmm?