Results 1 to 4 of 4
  1. #1
    Join Date
    Feb 2004
    Location
    In front of the computer
    Posts
    15,579
    Provided Answers: 54

    Unanswered: Anonymous logins by SC_MSSQL application

    We're getting a barrage of Windows Authenticated login attempts that are using the Anonymous login on one of our client's production servers. This smells to me of a service gone awry.

    The login attempts originate from a server that is hosting some Quest Software applications, specifically their Performance Analysis tool. This machine has been well behaved until this morning, but it has been issuing around ten failed login attempts an hour.

    The problem that it causing me pain at the moment is that the client has not renewed their Quest support yet because of a merger, so their contract recently expired. Does anyone have any insight into what might cause a normally well behaved app/server to go mildly berzerk exactly ten days after the support contract expires?

    -PatP

  2. #2
    Join Date
    Feb 2004
    Location
    In front of the computer
    Posts
    15,579
    Provided Answers: 54
    One new breadcrumb to throw onto the pile... The logins come in groups of eight in the same minute, approximately fifteen minutes apart.

    So far they only appear to affect one server (out of about a dozen), all originate on a single server that has no one logged in either at the machine or via RDP. The only obvious answer is that that machine is the Quest repository and application server, but I'm still trying to pin down other possible answers.

    -PatP

  3. #3
    Join Date
    Nov 2004
    Location
    on the wrong server
    Posts
    8,835
    Provided Answers: 6
    why not just turn the quest stuff off and see what happens?
    “If one brings so much courage to this world the world has to kill them or break them, so of course it kills them. The world breaks every one and afterward many are strong at the broken places. But those that will not break it kills. It kills the very good and the very gentle and the very brave impartially. If you are none of these you can be sure it will kill you too but there will be no special hurry.” Earnest Hemingway, A Farewell To Arms.

  4. #4
    Join Date
    Feb 2004
    Location
    In front of the computer
    Posts
    15,579
    Provided Answers: 54
    I'd already shut down Performance Analysis before I posted,and I've kicked the support issue "up the food chain" to try to get some action there. At this point I'm just trying to be prepared to answer questions, and I'm scrabbling for anything I can find.

    I'm not as familiar with the Quest tools as I'd like to be (although I've been farily impressed with what I've seen of them), so I'm trying to do what homework I can so that I already have answers when people come looking for them.

    -PatP

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •