littlelegs
MIS
Can anyone confirm that the workstation entry in events 529 and 681 is where the attempt was made? I was examining a server with RDP and there are a number of failed audit attempts on the security log - there isn't a corresponding Successful event so I don't believe the system has been compromised but I wanted to verify that the system that is under 'attack' is the one identified in the event.