EMERGENCY?: Windows Xp attacking Windows 2000 Server?

Hello,

I know you are probably not fond of Newbies starting a thread saying they have an emergency, but I need some help ASAP.



I am in a serouisly bad possetion, I have been choosen to migrate from a NT server to Windows 2000 server. The Windows 2000 server is fully patched, and has Black Ic 3.6, and Symantec Anti-Virus 8.01

I have a large portion of the Department of Windows XP Machines, when I connect to the Windows 2000 server, I can log on fine, and I can see all of my netowrk drives, and edit them normally.

BUT on my log, on the Windows 2000 server, on the black ice log it is saying that my Windows XP Machine are scan ports 80 and 443. This is highlighted as a major problem (within the black ice program). All the compurters in my department are in the allowed ip range on black ice. (including the Xp machines that are 'scanning' these ports.


My main question is how can I make it so the Windows Xp machines stop trying to search for open ports on port 80
and 443, and also is there a service that might be doing this?

Sorry for the urgency, and I know you miight get this alot but I am probably going to lose my job if I can not figure
this out in 3 days, and this was my last resort :-/ (I called my IT department and they gave me no help, they said
it was on me.


Also on a side note:
oes anyone know which ports the lsass.exe (LSA Shell) program uses to connect with the server (w2kserver)?


Another note: I have conacted my IT head department and they said it was all up to me to figure this thing out, so I am kind of in a bad posetion.

Please Help
Thanks for listening, and for the help.

- Andrew

I wouldn't really worry about it. Peeps from XP puters wanna browse the web: http (port 80) and https (port 443). Cheers!

Thanks, I have come to the conclusion, that it is no big deal. BUT my Manager (boss) is aware of it, and he would like to know several things about it before we continue with the migration, he wants to know why its happening, what (service, app) is casuing it to happen, and can it be stopped, or should it be stopped.


Peace.

Are you running IIS or web based apps with SSL?

Andrew,

This really is NOT my area so please forgive me if I am talking premium grade SH1T. I got rid of Black*** some years ago because I thought it was giving me somewhat "hypercautious" results.......could it be a software (firewall) problem. False positives and all that...cannot handle the mixed environment?.........I would never have it...heard too many tales of woe?....all those are hearsay of course...not my field, as I warned you.

Might I suggest that you get a trial of an alternative firewall product or two, and see if you get the same answers, and if they are highlighted the same. Also try a different AV products..........they will give you a 30 day trial..you do not have that long from what you say? You should really scan the lot with everything "on" as they say.

As for the threats to your job..........we have a saying over here............"the higher a monkey climbs a tree.........the more he shows his @ss" They really don't understand do they?

This is the mentality that allows things like 9/11 to happen."Do something about that fire alarm or you are fired"..............great I'll turn it off.................not quite the right thing to do, but that is what the "Boss" will achieve, and what he wants to (not) hear?.

Did you decide to go to 2000 server from XP?..............that is supposed to be backwards? I will bet that you have been put in a situation...you are not getting help because they are just after looking after themselves? They tried and couldn't hack it (oops...wrong turn of phrase in this environment? :) ) so they got you in as a "scapegoat" to take the blame?

I guess you should do some sample scanning of the XP clients?....just in case something got on them from the old XP server? You know, AV, trojans etc.

Also, try attaching a Win2K pro client, and see what you get with that. That is total "like to like", so it might tell you something.

I am pretty drunk now ( what do you mean you guessed that already) as it is 00.40 hrs here (Monday)

Good Luck my friend!

Johnno

Browsers like Opera, Internet Explorer used from the XP puters. Cheers!

<<<<<<<<<<
Are you running IIS or web based apps with SSL?
>>>>>>>>>>>

Nope IIS is disable, and there are no web base apps on the Windows 2000 Server.

BTW, open task manager/view/select columns/check PID/OK, now remeber lsass.exe's PID, then do a netstat -ano. Cheers!

Ileva:

Probably a silly question..... Why are you firewalling a production server from it's clients? If the server contains their data and you only have appropriate services running on the server to provide that data the server shouldn't need to be firewalled internally and will probably cause you little heartaches like this for the forseeable future.

I would move your firewall protection to the perimeter unless you have a specific reason for firewalling the server from your own machines.

WinXP has some odd behavier. If it tries to access a normal file share it will also try to use WebDAV. These are the port 80 and 443 connections you are seeing. Hook up a sniffer to make sure. You will notice WinXP doing an OPTIONS /filename when it tries to access a share. This seems to be by design. Go figure. :rolleyes:

Edit: This seems to be caused by the WebClient Service on XP. Try and disable this service and recheck. The WebClient service will try to use WebDAV to access the file/share before it will use smb.

Yes, my thoughts are why firewall the server? The firewall should be at the network perimeter. Firewalling the server is going to create all sorts of odd results because the relationship between a domain server and clients is complex and will involve a lot of ports being used.

To me, the holy trinity of security is up-to-date patches + anti-virus + firewall at the edge of the network.

I guess we're talking about a corporate environment here and not something nasty like a college?

lsass uses local ports and not remote ones so froget the side note quiestion :D .

Quote:

---

Originally posted here by dynamoo
Yes, my thoughts are why firewall the server? The firewall should be at the network perimeter. Firewalling the server is going to create all sorts of odd results because the relationship between a domain server and clients is complex and will involve a lot of ports being used.

To me, the holy trinity of security is up-to-date patches + anti-virus + firewall at the edge of the network.

I guess we're talking about a corporate environment here and not something nasty like a college?

---

There are many reasons to firewall the server as well as firewalling the perimiter.

If you have a large network that could be used by malicious employees to gain access to ther server.

You wouldn't want to leave a payroll server, for example, unprotected from the intranet.

Remember that allmost all acts of computer misuse are performed by a company's own employees.

Internal protections are very important

Steve: Unless I misunderstand the chap he has the data for these users machines on that server. Thus they are allowed access. If there is data on there that is not for public use such as the payroll you mentioned then that whole department should probably be separated from the rest of the network in another way such as a rotuer or other firewall.

Tiger Shark:

I don't think you have misunderstood the chap.

I was trying to point out to dynamoo that there are valid reasons for firewalls at other places than the perimiter.

And if you physically isolate the payroll staff you isolate them from the benefits of the rest of the network, but it's all a matter of how you approach security within the perimiter.

There are as many approaches as there are experts on the matter.

So if I've caused any confusion - my apologies - I know I've not helped the chap out at all.

Steve: NP.... Confusion is the normal state in my world..... ;)

You can isolate the payroll staff for example behind a $60 Linksys router/firewall and they can still receive the full benefit of the rest of the network but their resources would be invisible to the "unwashed masses".

I think we need a little more information regarding ileva's config before anyone can give a sensible answer.....

Quote:

---

WinXP has some odd behavier. If it tries to access a normal file share it will also try to use WebDAV. These are the port 80 and 443 connections you are seeing. Hook up a sniffer to make sure. You will notice WinXP doing an OPTIONS /filename when it tries to access a share. This seems to be by design. Go figure.

Edit: This seems to be caused by the WebClient Service on XP. Try and disable this service and recheck. The WebClient service will try to use WebDAV to access the file/share before it will use smb.

---

Can you give me any more information on WEbDav, and this WEbclient Service, if so that WOULD BE GREAT. I think you have hit the nail on the head, and I am so releaved, but not 100 percent confident YET.


Also, I have a firewall on my server because our hardware firewall is AWOL, and we need some secuirty ASAP, so we put blackice on. My dept. Ip range is put on the baclk ice as allowed users BUT not trusted. So they can access their files without being blocked, but stillmonitors activty.


Thanks ALOT GUYS!!

Ileva: Yeah.... Having the primary Firewall out to lunch is a bit of a bummer. If I understand you correctly the perimeter firewall is down but you have maintained public access for whatever reason and firewalled the server to protect it. In this case I would be _very_ concerned about the workstations. There's nothing quite like bringing the Primary Firewall back online only to find that someone is already behind it on a workstation.

Well the workstations also have 'Personal Firewalls' for Small Buisnesses, so hopefully they are okay. It seems that the reintroduction of the Firewall will not be a quick process, they are predictings months to a year...

not something nasty like a college
- Ehk, This is a department at a University, hence all the bueracracy and the lack of time spent on secuirty.


Thanks again.

Quote:

---

Originally posted here by ilevakam316
Can you give me any more information on WEbDav, and this WEbclient Service, if so that WOULD BE GREAT. I think you have hit the nail on the head, and I am so releaved, but not 100 percent confident YET.

---

I couldn't find anything really informative. But i've noticed this behaviour at home on my Little Freebsd server (with samba and apache). I did find this:

http://www.theeldergeek.com/webclient.htm
And this usenet posting kinda triggered the relation with WebClient.

I have lost firewalls in the past and any old box with Linux on it works great in a pinch. Especially considering the fact that my paranoid decision is to sever the network and taking some heat versus not having a firewall IN LINE with the internal network.

I hope you have also isolated the internal network THROUGH your server, for example you have 2 NIC cards and the internal network is on one and the internet is on the other. If not; your just opened up all the clients.

Windows XP is constantly saying to the world something like "Hi everyone I am Windows XP, here I am and this is what I have to offer. Will you be my friend?" In Windows networking terms, it's always anouncing it's services and asking who is on the network, what they have to offer, who they are and how to get the info.

Peace()

After scanning thru this thread rather quickly, I noticed that no one had mentioned the fact that WinXP has a nasty "habit" of connecting and reporting to Microsoft, which *might* account for some of these "unexplained" connections.

I would like to thank all of you for your help. Thanks alot.

The fix to the problem was as suggested before. It was the WEBDAV Service, which I shutdown by going to Services (in Control Panel -> Administrative Tools) and just turned off the WebClient service.

Again Many Thanks.