We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An account failed to log on.
Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID Account Name: db2admin Account Domain: SAYNAMY-4BF9DFF
Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc0000064
Caller Process ID: 0x0 Caller Process Name: -
Workstation Name: SAYNAMY-4BF9DFF Source Network Address: 18.104.22.168 Source Port: 1046
Detailed Authentication Information:
Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0