After an audit, I am trying to identify the applications generating anonymous binds on the Domain Controllers before the remediation happens.
So far, we only have the DCs logs, and that doesn't really give us an idea on what is causing these anonymous binds on the server.
Is there a way I could audit that from the server-side? The two options we have identified so far are:
- Windows Systems Logs, but it is likely to miss part of the picture
- Capturing the network traffic on the server and looking for packets towards the DCs