Help! Server being attacked!

[eweruk]

One of my servers is constantly being attacked though so far, I can't see that they are getting in. They are trying all the default user names that M$ would have, I have none of those.

Looks like they are using a program, cause the rapid fire login attempts are insane. Here is where is gets interesting, one person has managed to get the correct user names and keeps locking the accounts since I have fairly tough rules on incorrect user name/pwd.

Question is: How did they get the list of user names????

[vass0922]

They're trying a brute force attempt... chances are they dont' have a list of user names just giong through a dictionary.

If you have a firewall block off the IP that is diogn the attack.

[DVNT1]

Depending on your environment... one way a user list could might have been obtained: http://www.securityspace.com/smysecu...src=1&id=10150

[MTAtech]

You may want to configure a timeout on userIDs that, let's say, locks out the account for 20 minutes if there are three failed logins. This will considerably slow down a brute force attempt.

[MTAtech]

Also, enable 'Interactive login: Do not display last users name.' (Administrative Tools, Security Settings ->Local policies-> Security options). This will prevent one from getting the user id already in the dialog box.

[eweruk]

Actually, they are using something to get the specific user names cause we have very unique names, nothing in the dictionary.....

[eweruk]

Yes, I have the lock out after 5 invalid pwd and locked for 30 minutes....

Once one is locked they move to the next user name until that is locked....

[DVNT1]

Is this happening over the Internet?

Is this via MS Share, Terminal Server, IIS, or ?

[eweruk]

I believe terminal server at this point....

[MTAtech]

can you determine if it is inside you company's network or from the outside?