dcsimg
Results 1 to 4 of 4

Thread: Disabled User Login Attempts 600 seconds

  1. #1
    Junior Member
    Join Date
    Aug 2018
    Posts
    2

    Disabled User Login Attempts 600 seconds

    We have a tool in our environment that allows us to see login attempts, we have a disabled user account that has several login attempts at very odd times etc 2am in the morning. This is very unusual as this should not be the case. Being a novice in this field I don't have any idea of where to start looking for clues as to why this is happening. Any information on this issue would be greatly appreciated.

  2. #2
    Super Moderator rlirpa's Avatar
    Join Date
    Feb 2014
    Location
    MD, US
    Posts
    212
    Is the IP address local? Should it be?

    For example, Forums like these usually have IP addresses from around the world logging in at all hours of the day and night.
    Rad

  3. #3
    Junior Member
    Join Date
    Aug 2018
    Posts
    2
    After doing more research it seems that the IP address's along with the SIDs belong to two servers (DC, ADFS), can't figure out why they are trying to connect to a disabled user account.

  4. #4
    Super Moderator rlirpa's Avatar
    Join Date
    Feb 2014
    Location
    MD, US
    Posts
    212
    Hard to tell from here. Might be someone with remote access to the servers trying to use them to log in to a disabled user account?
    Rad

Similar Threads

  1. Replies: 13
    Last Post: January 17th, 2006, 06:29 PM
  2. Inactive - but disabled user accounts?
    By genXer in forum Newbie Security Questions
    Replies: 12
    Last Post: November 18th, 2005, 10:46 AM
  3. Vulnerability: Cisco Secure ACS NDS Expired/Disabled User Authentication
    By s0nIc in forum Network Security Discussions
    Replies: 3
    Last Post: February 10th, 2002, 03:01 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •