This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice / help would be greatly appreciated.
Authentication Ticket Request:
User Name: rosu Supplied Realm Name: my domain User ID: - Service Name: krbtgt/my domain Service ID: - Ticket Options: 0x40810010 Result Code: 0x6 Ticket Encryption Type: - Pre-Authentication Type: - Client Address: 127.0.0.1 Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint:
Now if you notice the user, for each event like this one.. the user name changes and they seem to be all alphabetical attempts if I would sort by date.. The IP here is internal on this one, but for most it is an outside IP such as 126.96.36.199 .. It seems the source port on the event changes as well. Take a look at another:
Reason: Unknown user name or bad password User Name: rout Domain: my Domain Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: my Server Hostname Caller User Name: my Server Hostname$ Caller Domain: my Domain Caller Logon ID: (0x0,0x3E7) Caller Process ID: 7576 Transited Services: - Source Network Address: 188.8.131.52 Source Port: 3030