0

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely.

Our remote hosts are mainly Windows XP and our ADs are W2K8. The remote hosts access them over SMB port 445

Is it normal for Windows hosts to access AD's remote registry? My colleagues confirmed with me that both host and AD is clean from virus with endpoint protection enabled.

Thanks.

Improve this question
2
  • 1
    Do you have a backup server that's backing up the System State of the DC? If so, that's probably the culprit.
    – joeqwerty
    Oct 5, 2012 at 2:39
  • @joeqwerty the remote hosts are not backup servers. Those are workstations. Thanks.
    – smitty user
    Oct 5, 2012 at 2:54

2 Answers 2

Reset to default
0

Can you find the offending host? No I see no reason for remote client machines to access a domain controllers registry. To do so, the remote connection should have to be authenticated with domain admin rights.

Improve this answer
3
  • Hi Bret, what about servers? Would it be normal if servers have the same kind of behaviour towards AD server? Thanks.
    – smitty user
    Oct 5, 2012 at 6:08
  • @smitty deploying software, monitoring or running remote configuration of some kind might. Otherwise no not normally.
    – Bernie White
    Oct 5, 2012 at 6:22
  • Yea no built in part of Windows or an AD network would have anything accessing the registry remotely of a DC. It's either 3rd party or a program that means to do harm, or your IDS is wrong.
    – Bret Fisher
    Oct 5, 2012 at 14:52
0

Based off of this cisco document, it is not uncommon for clients to access remote registry under normal use scenario. It does not, however, list the individual cases.

Remote registry may be caused by some of the following, (these are off the top of my head - not an exhaustive list)

  • Viewing the list of Scheduled Tasks that appear on an SMB share
  • Using the registry editor remotely
  • Using Performance Monitor to access performance counters of the remote computer
  • Using Event Log to access log entries of a remote computer
  • Some COM+/DCOM applications
  • Software asset management programs
  • Viewing the list of installed printers that are not shared on a remote computer (unsure of this one)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .