RE: how to stop hacking on my server
- From: "Alexander Rayborn" <alexander@xxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Mon, 5 Nov 2001 23:33:08 -0600
That's not a hack. That's typical W2K Kerberos policy changes that
happen whenever group policy refreshes occur.
--Alexander
-----Original Message-----
From: jose [mailto:pepa@xxxxxxxxx]
Sent: Monday, November 05, 2001 11:28 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] how to stop hacking on my server
http://www.ISAserver.org
hi,
every time at event log on sbs2000 server i have following messages
Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 617
Date: 6.11.2001
Time: 3:40:29
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Kerberos Policy Changed:
Changed By:
User Name: SERVER$
Domain Name: NET2000FAQ
Logon ID: (0x0,0x3E7)
Changes made:
('--' means no changes, otherwise each change is shown as:
<ParameterName>: <new value> (<old value>))
--
ISA server is configured in secure mode
I cannot found ip addres of hacker
can anyone help me?
Josef Kovar
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
alexander@xxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
