On our WS2012 R2, I see multiple 4625 logon audit failures. Anything between once every 5 minutes to 5 times a minute. The usernames that fail the logon attempt change frequently. But seem to be from a list of commonly used usernames (Administrator, User, Test, Sales, Bob, Intern, Admin2, BOARDROOM, BARBARA, ALAN, COPIER, BACKUP, XEROX, USER1, RECEPTION etc. ). These failed attempts also seem to continue 24/7.
Since we are a pretty small company, I am quite sure that these are not legit attempts and are automated.
Below is an example log from Windows logs security.
Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: BOARDROOM Account Domain: Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0
Am I right to worry that we are hacked? How would I find out from where these failed logon attempts are coming from and stop them?