How to deal with security?

[Ovatvvon]

I received the following in my event log security section:


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 8/5/2002
Time: 4:47:16 PM
User: NT AUTHORITY\SYSTEM
Computer: WTWDB1
Description:
The logon to account: JOE CONLON
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: \\JOYCE
failed. The error code was: 3221225572



How can I find out more information about the person that tried to get onto my system such as the IP address of their machine, or anything else?
-Ovatvvon :-Q

 

[jmerencilla]

since you already know the pc name (\\joyce) use PING to know the IP assigned to Joyce

c:\>ping joyce

hope this helps

 

[Ovatvvon]

That won't work. My network consists of one computer at home which I'm running the server on to educate myself. There is no computer named Joyce. That's my problem...it's somebody from outside trying to log onto my network.

Any ideas of what I can do or how I can go about finding out any additional information about this? -Ovatvvon :-Q

 

[jmerencilla]

have you tried pinging WTWDB1 or is WTWDB1 the name of your PC?

 

[jmerencilla]

just found this:

http://www.microsoft.com/technet/tr...windows2000serv/maintain/monitor/logevnts.asp

 

[bikerbry]

Try a personal firewall such as BlackIce ... or a Watchguard SOHO ....

Bry

 

[Ovatvvon]

jmerencilla,
I think that link will be helpfull. I'll look at it when I get home from work at let you know. (Yes, wtwdb1 is the server name here)

bikerbry, this is a server running web sites along with my personal use. I want to use it not only to learn how to use it professionally, but also I want to use it professionally now. From my understanding, BlackIce will slow things down a bit, but moreso, it will interfere with internet traffic. I don't want to do that, I just want to have reliable security procedures here incase unauthorized people try to get onto this network.

-Ovatvvon :-Q