Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures:

>gpedit.msc

Local Computer Policy
   Computer Configuration
      Windows Settings
         Security Settings
            Local Policies
               Audit Policy
                  Audit logon events: Success, Failure

And now the logs are filled with failure events like:

Logon Failure:
    Reason:                 Unknown user name or bad password
    User Name:              server
    ...
    Logon Type:             10
    Logon Process:          User32  
    Authentication Package: Negotiate
    ...
    Source Network Address: 82.114.195.29

While Logon Failure events sure are interesting, i'm more interested in Logon Success events - i want to see if anyone got in. That means it's not all Logon Success events i wants, just ones from foreign networks.

i want to filter the Windows Security Event log to show:

  • Event type == "Failure audit"
  • "Source Network Address" is from the internet

Or for the more programmer oriented:

(EventType == FAILURE_AUDIT) &&
(SourceNetworkAddress & 0xffffff00) != 0x0a000000

Possible?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Event viewer won't allow you to filter on criteria in the "Description" field, which is what you need to differentiate between "local" networks and "foreign" networks.

My sshd_block script could be altered to do what you're looking for, or you could probably cobble something together using the event log email notification script I wrote for an answer on Server Fault. Either one, however, doesn't have rate limiting on the notifications (which I really should get around to writing in my "copious free time"...)

share|improve this answer
    
Accepted for "Event viewer won't allow you". –  Ian Boyd Nov 15 '10 at 2:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.