Server Performace Reports HELP!!

[cwhiteuk]

Hi

Just set a Windows 2003 SBS Premium, got our first performance report through this morning and had something that I don't know if I should be worried about or not -

Logon Failure:
Reason: Unknown user name or bad password
User Name: guest
Domain: USER-BA28AB235F
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: USER-BA28AB235F
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 24.81.214.232
Source Port: 0

Total occurances - 3983

Time of this was 04:30 this morning when no one was on site. There is then a message that the guest account is locked out.

Anyone help?

 

[elmurado]

Two things.
1.Is the source IP on your network?
2.It looks like almost 4000 attempts to get in too. The guest account should be disabled by default and also checking is sometimes a good way of seeing if someone's attempting a hack.
That many attempts is worrying.
Is your machine patched up to date?
Have you renamed the administrator account or copied it to something with a different name and then disabled it?

Also, in future you may want to mask any IP's if you think they're giving too much info. Type it as 192.x.x.x etc. I learnt the hard way ;-).
Check your event logs too for that time.