Have a Windows SBS Server I've encountered which I have suspicions it's been compromised in some way.
11.8gb of 12gb total RAM at all times, even after restricting the Exchange store to 4gb.
Multiple instances of w3wp.exe which I understand are IIS databases running. 9 in total using over 1gb of RAM.
Multiple login failures appearing in Event log.
Windows Update turned off, not through obvious GPEdit policies. 45 outstanding Windows Critical updates.
Disabled firewalls (inbuilt and Kaspersky). Hardware firewall (on router) is running and configured for incoming RDP, FTP, SMTP directed to Server.
Ongoing slowness of the network regardless of any 'upgrades' (gigabit cards fitted to all Workstations).
What should be my next steps? How can I track where and what IIS databases have been setup/run. How about SQL server, would you expect that to be running with Exchange and FTP? Any tools I can run to check what has been opened on the server?