User permission problem

[Adicken]

We currently have a number of Windows 2003 servers hosting 1200 student accounts. Recently one of the servers started grinding to a halt with the processor maxing out at 100%. On investigation it appeared that the number of user connections was really high. It appreared that certain users were connecting to other user area shares for no apparaent reason. We have ran virus and ad aware software, both of which turn up nothing. Our only work around is to rename the users share and change it in their profile as well. This is time consuming and not the root of the problem.

Does anyone have any ideas on this or whats causing it? It's driving us nuts as it is rendering the server (and the network) useless.

Thanks

Andy

 

[needcoffee]

Andy,

Has anyone examined what files are in these shares? Is there any pattern to which shares are being accessed and by whom? You say the network is also grinding to a halt, is anyone monitoring what is causing the traffic?

Sounds like you need to stop users from accessing others' shares. If feesible under the security and use policy you organization has, put some permission controls in place so this cannot happen.

needcoffee

 

[Adicken]

Is there anything in Active directory that we can change? This is an educational establishment network and uses certain software for delivery of apps etc. The user areas are shared to the everybody group. Is this the best way? Sorry, but i'm a bit of a novice.

Andy

 

[iownroot]

Sharing anything to the everyone group is a bad idea. You asked is there anything you can do in active directory. Are these students logically seperated in any way via groups, subdomains, or OU's? Do you have any group policies applied? You said, "On investigation it appeared that the number of user connections was really high. It appreared that certain users were connecting to other user area shares for no apparaent reason. We have ran virus and ad aware software, both of which turn up nothing". Has the user host machines that are causing the problems protected properly? There's a nasty guy I've run across before named W32/SDBOT Worm, and this has him written all over it (or one of his cousins). What virus scan have you done, and what adware program have you used?

CISSP, MCT, MCSE2K/2K3, MCSA, CEH, Security+, Network+, CTT+, A+

 

[Adicken]

Thanks for the advice. The students are logically seperated into their year groups. All come under one domain though. We have a number of group policies. We have a stations policy, and a user policy, all controlled by an overall group policy. (hope your with me on this one). We have ran anti virus on all stations and servers (we use sophos antivirus). We have even re ghosted our stations with new images from clean clones. We have also ran adaware, and microsoft spyware, both of which turn up nothing in particular. What would you suggest we use? We have found that changing a users share name seems to stop the problem, although it is hard keeping on top of it when you have 1200 users. I was unsure if there was a batch file i could use to do this? Any ideas?

I really don't know where else to turn. We have had a couple of engineers in but they can't seem to fathom it out either. Any further help or advice would be very appreciated.

Thanks

Andy