TS session without username

our client has terminal server 30 people access internet. we have been noticing login  @ ts not show on "users" tab, shows on "sessions" tab shown link: http://www.chicagotech.net/remoteissues/ts4.htm

it appear minute, disappear, reappear different id. know might b. hacking attempt? i've never seen before, trying connect. don't know "connected" means...

1 time, client user name iphone using id 0 should console session. right? ideas?

 

---

bob lin, ms-mvp networking, internet, routing, vpn troubleshooting on

http://www.chicagotech.net

how setup windows, network, vpn & remote access on

http://www.howtonetworking.com

hi bob,

i see screen shot server 2003, response reflect that.

when user attempts connect ts using remote desktop client , makes server's logon screen, session in connected state.  if authenticate session transition active state.  if not enter valid credentials within timeout period, or enter invalid credentials many times, session end.

the symptoms seeing may user or users have temporarily forgotten user name/password and/or typing incorrectly and/or getting distracted before completing logon.  in rare cases have seen connection problems cause users--they logon screen, not complete process before getting disconnected.  of course possible unauthorized person attempting access server.

you need more investigation make determination.  make sure failure/success auditing of logons enabled, , check security log clues.  example, if someone attempts log on invalid credentials see 529 event (failure audit) user name used source ip address.  for successful logons see 528 event (success audit) with the username , source ip.  other pertinent piece pay attention client names show in ts manager when happens , compare client names have logged on successfully in past.

examine logs match between ip addresses notice strange connection attempt versus ip addresses connect.  if there matches know user having issues or if ip address or addresses keep making failed attempts know if server under attack.  there automated programs will keep attempting connect ts servers on internet using username/password guessing.  1 of common clues series of attempted logons user name of administrator.

if maximum number of failed logons is reached during single session see event entry termservice in system log well.

-tp 

Windows Server  >  Remote Desktop Services (Terminal Services)