Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Excessive AD login attempts

We have a UCS system configured for LDAP authentication against Active Directory. Everything is working as expected, but on the DCs we are seeing excessive failed login attempts originating from the fabric interconnect IPs against an invalid domain account. We are seeing anywhere from hundreds to thousands of attempts per day, so I don't believe these are due to invalid GUI login attempts or anything user driven. I've dug through the GUI but cannot find anything that would be using that account. The BindDN is set to use a different account created solely for this purpose. An example from the event log is posted below (192.168.32.12 is the primary FI). Any thoughts?

An account failed to log on.

Subject:

    Security ID:        SYSTEM

    Account Name:        LP-DC02$

    Account Domain:        CO

    Logon ID:        0x3e7

Logon Type:            3

Account For Which Logon Failed:

    Security ID:        NULL SID

    Account Name:        Admin

    Account Domain:        CO

Failure Information:

    Failure Reason:        Unknown user name or bad password.

    Status:            0xc000006d

    Sub Status:        0xc000006a

Process Information:

    Caller Process ID:    0x1dc

    Caller Process Name:    C:\Windows\System32\lsass.exe

Network Information:

    Workstation Name:    LP-DC02

    Source Network Address:    192.168.32.12

    Source Port:        43342

Detailed Authentication Information:

    Logon Process:        Advapi 

    Authentication Package:    MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

    Transited Services:    -

    Package Name (NTLM only):    -

    Key Length:        0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The  Subject fields indicate the account on the local system which requested  the logon. This is most commonly a service such as the Server service,  or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).


Everyone's tags (4)
1 REPLY
Silver

Excessive AD login attempts

Hi Brad,

I checked my lab setup and do not see anything similar, can you let me know the UCSM version and i can check for that specific version.

Is there is any other AD intergation? back-up job? KVM access etc?

feel free to open a TAC case if you wish to and we should to able to look into the logs and figure out if there is a request going out from UCS for authentication of a specific account.

Thanks!

./Abhinav

896
Views
0
Helpful
1
Replies
CreatePlease to create content