Security alert Event ID:4625 Logon type: 3 from IP 89.248.167.x

hi, having lot (thousands) of failed logon attempts daily 6 or 7 ip addresses 89.248.167.x or 58.247.6.x etc.

most of source ips appear originate in china or amsterdam , in north america. usernames tried , failed today (these not in our ad):

administrator
guest
rallogon
rdssupport
t1
administrator
aloha
bms
brink
brinkpos
celerant
celerant01
celerant1
ecwsupport
eeepciuser
eeeposuser
eeeuser
ibs
ics
kayne120
ken
kipm
mbm
mbm2
polling
pos
pos22
post1
post2
qubica
rbms
rds
rdspos
shlomo
sysdba

example system log (items in<> have changed protect potentially sensitive information):

- system 

  - provider 
   [ name]  microsoft-windows-security-auditing 
   [ guid]  {54849625-5478-4994-a5ba-<changed>} 
   eventid 4625 
   version 0 
   level 0 
   task 12544 
   opcode 0 
   keywords 0x8010000000000000 
  - timecreated 
   [ systemtime]  2016-01-20t03:36:06.246855200z 
   eventrecordid 1154657 
   correlation 
  - execution 
   [ processid]  580 
   [ threadid]  4440 
   channel security 
   computer <correct local address entered here ie "computer1.domainname.local"> 
   security
- eventdata 
  subjectusersid s-1-0-0 
  subjectusername - 
  subjectdomainname - 
  subjectlogonid 0x0 
  targetusersid s-1-0-0 
  targetusername celerant 
  targetdomainname  
  status 0xc000006d 
  failurereason %%2313 
  substatus 0xc0000064 
  logontype 3 
  logonprocessname ntlmssp  
  authenticationpackagename ntlm 
  workstationname \\89.248.167.140 
  transmittedservices - 
  lmpackagename - 
  keylength 0 
  processid 0x0 
  processname - 
  ipaddress 89.248.167.140 
  ipport 57182 

can shed light on , assist preventing please?

thanks!

hi,

name="logontype ">3</data>" means network access. one of common sources of logon events logon type 3 connections shared folders, printers or iis. status 0xc000006d means either due bad username or authentication information.

in opinion, to block authentication access unknown ip network segment, best solution allow special ip network segment communication though firewall or block unknown ip network segment again , again checking event log.

best regards,

alvin wang

---

please remember mark replies answers if , un-mark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Security