I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely.
Our remote hosts are mainly Windows XP and our ADs are W2K8. The remote hosts access them over SMB port 445
Is it normal for Windows hosts to access AD's remote registry? My colleagues confirmed with me that both host and AD is clean from virus with endpoint protection enabled.