Remote hosts accessing AD's registry

Posted by smitty user on Server Fault See other posts from Server Fault or by smitty user
Published on 2012-10-05T02:23:42Z Indexed on 2012/10/05 3:40 UTC
Read the original article Hit count: 408

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely.

Our remote hosts are mainly Windows XP and our ADs are W2K8. The remote hosts access them over SMB port 445

Is it normal for Windows hosts to access AD's remote registry? My colleagues confirmed with me that both host and AD is clean from virus with endpoint protection enabled.

Thanks.

© Server Fault or respective owner

Related posts about windows-server-2008

Related posts about active-directory