Suggestion on how to track a bad password source?

Posted by tinman1997@reddit | sysadmin | View on Reddit | 37 comments

So my company have around 150 machines and NONE of them join domain We're add the domain user name on each machine's credential manger and use it to map a network drive. Now a certain user name on domain got constantly locked out by the DC and i havent tracked down this mysterious machine for weeks now Note: i cant create new user name because i tried that earlier. This user name tied to a certain software that the company use and a whole lot of ntfs permissions that i doesnt fully understand

Reply to Post

37 Comments

[-]

mac10190@reddit

Microsoft Account Lockout Tool https://www.microsoft.com/en-us/download/details.aspx?id=18465[https://www.microsoft.com/en-us/download/details.aspx?id=18465](https://www.microsoft.com/en-us/download/details.aspx?id=18465) Hopefully this can help you narrow it down.

[-]

ByteMyHardDrive@reddit

As others have said, check the event log for failed authentication attempts to track the source. You can search for specific event IDs in the Security log, which should help you find the hostname(s) you’re looking for. This is just to help you deal with your current situation. You can probably tell from how dumbfounded and abrasive some of the other comments are that this setup is a really, *really* far cry from how it should be. All the workstations should be domain joined, and each person or function should have their own credentials to access domain resources. I don't know if I'm misunderstanding, but it also sounds like you’re sharing credentials to map resources across multiple devices. Those are two pretty big design issues. Your boss has absolutely failed you, and that’s not okay. I cannot overstate how important it is to look past the abrasive or funny comments and understand why these points matter. If your boss refuses to budge, at the very least, this is a learning experience on what not to do.

[-]

BWMerlin@reddit

Let's start simple, why are these computers not domain joined AND you are trying to map domain resources?

[-]

tinman1997@reddit (OP)

Because my boss said so? He said "Our system isnt powerful for all the computer to join domain. It would put a strain on the server"

[-]

Top-Yellow-4994@reddit

is he the sysadmin?

[-]

Euphoric-Blueberry37@reddit

I don’t think this bloke is the sysadmin, this setup reads all sorts of stupid

[-]

tinman1997@reddit (OP)

Im just an IT helpdesk guy. My boss is the deputy head of department. He just dont care about the system admin stuff that much. He leaves this case to me and my co-worker to solve

[-]

gilean23@reddit

You should not be dealing with things like this in a help desk role. These are issues for a sysadmin. If he wants you doing sysadmin work, he needs to give you sysadmin job title and pay.

[-]

Euphoric-Blueberry37@reddit

Mate. Either call this idiot out for being very stupid, or have a dig around and see what the DC is actually doing, I’m putting money on a crypto miner

[-]

Jeff-IT@reddit

I don’t claim to be the greatest sysadmin but even I know better 😭

[-]

shaolinmaru@reddit

Are you using a 486 as a DC?

[-]

pmandryk@reddit

Commodore 64 is being re-released. I suggest you upgrade to this for a DC. Nothing will go wrong. Trust me. /s

[-]

Furnock@reddit

Not a chance. My Timex Sinclair is both a door stop and a DC

[-]

Euphoric-Blueberry37@reddit

Your boss might be talking shit

[-]

isuckatrunning100@reddit

The boss is running a Bitcoin mine on the server.

[-]

titlrequired@reddit

‘Might’ is doing a lot of work in that sentence 🤣

[-]

Crackmin@reddit

God damn you have a golden opportunity here "Hey boss, I optimised the servers so everyone can join the domain now" Assuming you're not running everything on a piece of buttered toast and a potato battery

[-]

Shiveringdev@reddit

I had a boss like that. He was old as dirt and had short legs and looked like cotton hill in a suit. He worked his way up from a warehouse worker over the years and said we couldn’t have managed switches because they were not needed and sold your data to Russia. I left quickly and wouldn’t you know it, they had data breach not long after.

[-]

MiningDave@reddit

Did your boss say that or did some other IT person / MSP tell them that while trying to sell them a more powerful server?

[-]

Ur-Best-Friend@reddit

Your boss needs to find a more appropriate career. I recommend "horse manure shoveler", somebody has to clean up the horseshit he's been spewing anyways.

[-]

Akamiso29@reddit

Is….is this AD? I What?

[-]

BWMerlin@reddit

To put things kindly, your boss is wrong.

[-]

beritknight@reddit

Holy shot what a mess. Are you the only IT person? Usually the event log on the domain controller would show the user name and machine name. How many domain controllers do you have?

[-]

tinman1997@reddit (OP)

We have 3. Yeah......Because my boss has a very short fuse and on top of that i also have a timid personality. I rarely ask for his advice. Is either i tried to solve the problem by myself or my co-worker helped me My boss is more like a database dev type of guy and system admin second

[-]

fedesoundsystem@reddit

Event id 4625 should be a starting point. Use chatgpt to get the queries inclusing the user name eon event viewer

[-]

Powerful_Channel_223@reddit

This? Leave it enabled long enough to capture the bad password attempt and then you can associate username. I presume each user has a unique name. https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enable-debug-logging-netlogon-service

[-]

Exfiltrate@reddit

Time to join all the systems to the domain and become a sysadmin.

[-]

volrod64@reddit

Are you trolling or not ?

[-]

tinman1997@reddit (OP)

Bro, i dont know how to tell you this. Believe me i had a nightmare at night 'cause i was trying to solve this case

[-]

volrod64@reddit

There is no nightmare to have, get a fcking DC and put every machines on the domain. That's it THAT'S HOW IT WORKS AND WHY IT EXISTS !!!!!I And if the manager and I don't know who that is tell you that's not the solution .. show him the whole reddit saying that he's a dumb mf

[-]

doalwa@reddit

„So my company have around 150 machines and NONE of them join domain“ Yeah sorry buddy, that’s when I zoned out.

[-]

IFeelEmptyInsideMe@reddit

We start pushing for domain joined or Intune joined system at literally like 5ish computers. It just makes life easier. Especially with network drives and server hosted programs like QB.

[-]

alpha417@reddit

Did your boss tell you to come here, and ask this??

[-]

dano5@reddit

the event log on the domain controller should be able to show the source of the login, you might have to enable audit logging though

[-]

dvr75@reddit

This, search eventlog under security for event number 4740 (user account was locked out).

[-]

Recent_Carpenter8644@reddit

Yes, first place to look. It should list the name of the computer trying to log in. If that field is blank, it's not a Windows machine. Could be a phone, a Mac, Linux. I prefer to look at event ID 4625, so I can see all the attempts before the lockout. It shows the workstation name too, if available.

[-]

dlucre@reddit

This is insane. That said, Rename the user in ad and update the workstation to use the new Username.