How to close the logon process named NtLmSsp ?
- by Aristos
I have a windows 2003 server and time to time I am getting many login failures like this one.
Logon Failure:
Reason: Unknown user name or bad password
User Name: administrator
Domain: xx.xx.xx.xx
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: XLHOST
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 173.45.70.100 <- hacker
Source Port: 4722
AND
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user
Source Workstation: XLHOST
Error Code: 0xC0000064
The question is, how can I close this process of login ?, what I have left open and some one can try to login ?
Some notes:
I login to the server using tunneling, nothing is open except dns, email, and web ports, not even ftp, and all default ports are change and hidden. I also monitor port scan and capture any one that try to find the hidden ports.
Probably it is something open...
Thank you in advanced.
