i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures:
>gpedit.msc Local Computer Policy Computer Configuration Windows Settings Security Settings Local Policies Audit Policy Audit logon events: Success, Failure
And now the logs are filled with failure events like:
Logon Failure: Reason: Unknown user name or bad password User Name: server ... Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate ... Source Network Address: 18.104.22.168
While Logon Failure events sure are interesting, i'm more interested in Logon Success events - i want to see if anyone got in. That means it's not all Logon Success events i wants, just ones from foreign networks.
i want to filter the Windows Security Event log to show:
- Event type == "Failure audit"
- "Source Network Address" is from the internet
Or for the more programmer oriented:
(EventType == FAILURE_AUDIT) && (SourceNetworkAddress & 0xffffff00) != 0x0a000000