Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations TouchToneTommy on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

IP Address discover.

Status
Not open for further replies.

rrgg

Technical User
Jun 20, 2003
35
IT
Hi all,
How to discover IP address of who is being attempt to unauthorized logon to Windows 2000 Server?

Thanks.
 
Please, if possible, someone answer to the question.
Thanks.
 
Best bet would be to get yourself some third party software like a firewall that will identify the culprit. Bear in mind, not all of the addresses it gives you are the actual "hacker".
 
How are they logging in? If it is via IIS then look at the logs in c:\winnt\system32\logfiles

Otherwise - if you mean file shares etc - then switching auditing on for logon/logoff events and examine the event log. That will usually give a machine name - then just go to DNS server and reverse lookup the thing. If it has been cleared out of there you could always check DHCP leases - and also the WINS name lookup.

M.

Hollingside Technologies, Making Technology work for you.
 
Thank you for answers!!!

The log-on possible is:
By Terminal Services
By FTP
By HTTP

rrgg.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top