I have a Server that makes authentication requests once a minute using credentials of an Administrator that has left the organization. The account is disabled. I have made the expected sweep of Services to make sure none are running under the Admin credentials in question. I have searched the registry for a connection between the user account and a Process, but found nothing. What is the best way to narrow down what Process/Application is making the authentication requests using this disabled account? The Server in question is setup as a VMWare Horizon View Connection Broker, which was setup originally by the owner of the now disabled account making the persistent authentication calls. I see the failed requests on the Domain Controller. I can capture and review the packets via Wire Shark, but there is no Application/Process information there. How can I connect the Authentication requests to a process?
We have a few scripts we run on a regular basis to scrape our DCs for account lockouts. The lockout event usually shows the source IP and name of the failed authentication source.
As a follow up the scripts attempt to check the event log of the source for a failed authentication attempt. Doing so yields the process Id and usually the process name which was used to authenticate.
You say you know which host the failed requests are coming from so you should be able to filter the security event log for "Audit Failure" events. Seeing events that occur every minute might lead you more quickly to an event that will give you what you're looking for.
The problem is that sometimes it's a generic process (e.g svchost.exe). This is where the process ID comes in handy. Task manager should be able to show you the service info for a particular process ID. Failing that, procexp certainly will.
Common places to look (including ones you already mentioned) are:
- Scheduled Tasks
- Terminal sessions (usually symptomised by periodic occurrences)
My answer makes the assumption that failed login event auditing is enabled by default, it is in our environment. enable auditing of account login events