Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely.

Our remote hosts are mainly Windows XP and our ADs are W2K8. The remote hosts access them over SMB port 445

Is it normal for Windows hosts to access AD's remote registry? My colleagues confirmed with me that both host and AD is clean from virus with endpoint protection enabled.


share|improve this question
Do you have a backup server that's backing up the System State of the DC? If so, that's probably the culprit. – joeqwerty Oct 5 '12 at 2:39
@joeqwerty the remote hosts are not backup servers. Those are workstations. Thanks. – smitty user Oct 5 '12 at 2:54

Can you find the offending host? No I see no reason for remote client machines to access a domain controllers registry. To do so, the remote connection should have to be authenticated with domain admin rights.

share|improve this answer
Hi Bret, what about servers? Would it be normal if servers have the same kind of behaviour towards AD server? Thanks. – smitty user Oct 5 '12 at 6:08
@smitty deploying software, monitoring or running remote configuration of some kind might. Otherwise no not normally. – Bernie White Oct 5 '12 at 6:22
Yea no built in part of Windows or an AD network would have anything accessing the registry remotely of a DC. It's either 3rd party or a program that means to do harm, or your IDS is wrong. – Bret Fisher Oct 5 '12 at 14:52

Based off of this cisco document, it is not uncommon for clients to access remote registry under normal use scenario. It does not, however, list the individual cases.

Remote registry may be caused by some of the following, (these are off the top of my head - not an exhaustive list)

  • Viewing the list of Scheduled Tasks that appear on an SMB share
  • Using the registry editor remotely
  • Using Performance Monitor to access performance counters of the remote computer
  • Using Event Log to access log entries of a remote computer
  • Some COM+/DCOM applications
  • Software asset management programs
  • Viewing the list of installed printers that are not shared on a remote computer (unsure of this one)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.