Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Windows 2008R2 server that is reporting failed login attempts from a number of workstations on our network. Some event log details:

Event ID 4625, Status: 0xc000006d, Sub Status: 0xc0000064
Security ID: NULL SID, Account Name: joedoe, Account Domain: Acme
Workstation Name: WINXP1, Source Network Address: 192.168.1.23, Source Port: 1904
Logon Process: NtLmSsp, Authentication Package: NTLM, Logon Type: 3 (network)

I believe this is coming from some netbios service or similar (maybe the file explorer), keeping an inventory of its network neighborhood and also trying to authenticate.

Is there a way to turn this off without having to turn off file sharing all together? In other words, clients authenticating against file servers that they use is of course no problem, but I want to eliminate clients trying to authenticate to servers that they are not using and have no business with. The above example is only one of thousands of log alerts for similar failed network authentications.

What can I do to clean this up / handle this?

share|improve this question
1  
Clients don't randomly access network resources. Clients also don't normally maintain the network browse list. Even if they did (and they can in certain scenarios) they don't authenticate or attempt to log on to any other host to build said list. –  joeqwerty May 30 '12 at 22:38
    
I agree with @joeqwerty, clients do not randomly access network resources. Are you sure that these specific workstations are virus free? Do you recognize the usernames it is trying to authenticate with or are they generic? –  Nic Young May 30 '12 at 22:55
    
What anti-virus and anti-malware software are you using? Maybe it's time to get something better and scan every machine properly. Your symptoms suggest your systems have been compromised. –  John Gardeniers May 31 '12 at 0:30
    
We are using ESET NOD32 and they are updated with the latest signatures. The authentication attempt happen as the user logs in, with the same login name as the user. I have checked the machines and cannot find any signs of malware, viruses or other uninvited stuff. –  Jim Balo Jun 1 '12 at 1:06
    
What services is the server providing? File services? Print services? Does the user have a drive letter mapped to a share on the server? –  joeqwerty Jun 1 '12 at 11:04

1 Answer 1

Given the solution you found, I suggest removing items from the Network Places folder. One easy way to do this is via batch during login:

RD /S /Q "c:\Documents and Settings\%1\NetHood\" >nul
MD "C:\Documents and Settings\%1\NetHood\"
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.