1

I have a Windows 2008R2 server that is reporting failed login attempts from a number of workstations on our network. Some event log details:

Event ID 4625, Status: 0xc000006d, Sub Status: 0xc0000064
Security ID: NULL SID, Account Name: joedoe, Account Domain: Acme
Workstation Name: WINXP1, Source Network Address: 192.168.1.23, Source Port: 1904
Logon Process: NtLmSsp, Authentication Package: NTLM, Logon Type: 3 (network)

I believe this is coming from some netbios service or similar (maybe the file explorer), keeping an inventory of its network neighborhood and also trying to authenticate.

Is there a way to turn this off without having to turn off file sharing all together? In other words, clients authenticating against file servers that they use is of course no problem, but I want to eliminate clients trying to authenticate to servers that they are not using and have no business with. The above example is only one of thousands of log alerts for similar failed network authentications.

What can I do to clean this up / handle this?

Improve this question
8
  • 1
    Clients don't randomly access network resources. Clients also don't normally maintain the network browse list. Even if they did (and they can in certain scenarios) they don't authenticate or attempt to log on to any other host to build said list.
    – joeqwerty
    May 30, 2012 at 22:38
  • I agree with @joeqwerty, clients do not randomly access network resources. Are you sure that these specific workstations are virus free? Do you recognize the usernames it is trying to authenticate with or are they generic?
    – user89350
    May 30, 2012 at 22:55
  • What anti-virus and anti-malware software are you using? Maybe it's time to get something better and scan every machine properly. Your symptoms suggest your systems have been compromised.
    – John Gardeniers
    May 31, 2012 at 0:30
  • We are using ESET NOD32 and they are updated with the latest signatures. The authentication attempt happen as the user logs in, with the same login name as the user. I have checked the machines and cannot find any signs of malware, viruses or other uninvited stuff.
    – Jim Balo
    Jun 1, 2012 at 1:06
  • What services is the server providing? File services? Print services? Does the user have a drive letter mapped to a share on the server?
    – joeqwerty
    Jun 1, 2012 at 11:04

1 Answer 1

Reset to default
0

Given the solution you found, I suggest removing items from the Network Places folder. One easy way to do this is via batch during login:

RD /S /Q "c:\Documents and Settings\%1\NetHood\" >nul
MD "C:\Documents and Settings\%1\NetHood\"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .