1

For the past month or so, a computer that is on the same domain as me has been spamming my computer with logon/logoff requests via kerberos. I get ~4,000 requests on my computer a day. This includes two logon requests, followed by two logoff requests. The only thing that changes between the requests is the Source Port as listed below. I know that this can be stopped by simply enabling my firewall, but I am trying to figure out a few more details as to what is going on before confronting the person about the activity.

1) I understand that this is an automated service, but is there a way for me to tell what the process name is that is initializing the requests on the target machine, rather than the host machine?

2) Any suggestions as to what programs could be doing this, so I know what I am looking for?

Below is a sample of the data that is listed in the event viewer:

Logon Type:         3

New Logon:
    Security ID:        $Domain\$User
    Account Name:       $User
    Account Domain:     $Domain
    Logon ID:       0x1ca045c
    Logon GUID:     {698cd7b2-a521-4c52-0278-e363b08300ef}      -

Network Information:
    Workstation Name:   
    Source Network Address: --Removed--
    Source Port:        51065

Detailed Authentication Information:
    Logon Process:      Kerberos
    Authentication Package: Kerberos
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

0

You must log in to answer this question.

Browse other questions tagged .