Why is my server trying to log on with my email address..?

[Koldov]

I have set-up my server to log Kerberos Authentication tickets so I can see who is trying to log on.

 

It seems to work fine and I can see successful and unsuccessful attempts (hoping to find any brute force type attacks).

 

However, occasionally (a couple of times a day) I see that an unsuccessful attempt was made to requset a Kerberos ticket using my email address.

 

I am wondering if some sort of service is trying to gain access, but it is not even my main school email address so I am completely lost on how I would even start to track it down.

 

Nothing seems to be broken and we have not been made aware of any services not working or any data not being uploaded (Groupcall, Wonde etc.) so I don't know how to find out what is trying to use this 'account' to log-on.

 

Any ideas?

Edited September 3, 2020 by Koldov

[mavhc]

is it an email address that's also a userPrincipalName?

[Koldov]

is it an email address that's also a userPrincipalName?

 

Any ideas on how to check for this?

 

I've searched AD and it doesn't appear there as far as I can see.

[mavhc]

In ADUC, a user properties page, account tab, top option in user login name, that's the UPN, 2nd row is Pre Windows 2000 one that everyone actually uses

 

So does the top row match your email address? It looks like an email address you see, user@domain

[Koldov]

Ah yes, sorry I got that bit.

 

I was wondering how to search through the entire AD structure for it (it isn't on my account).

 

Found this and ran it, but it doesn't appear to be in the results (and it appears to be only for 'users' obviously)...

 

get-aduser -filter * | Export-Csv c:\myusers.csv

[mavhc]

right click domain in ADUC, find>advanced>field>logon name>put in email address

[Koldov]

Ok thanks, that's done...

 

'No items match the current search'

 

Guess it's not anything to do with a 'user' as such?

 

Must be some sort of service/3rd party provider data extraction/scheduled task I've set up at some point.

 

Thing is, I checked the ones I know of and they are all set to use system or admin credentials I think.

 

EDIT: Not sure I should admit that...

[mavhc]

can you see the ip? sometimes it's only visible in the xml view

[Koldov]

can you see the ip? sometimes it's only visible in the xml view

 

 

 

Yeah it is in the 'General' view and it's the IP of my work PC...

 

That will give me some extra avenues for troubleshooting.

 

Thanks for that, good shout!

 

At least it isn't something on the server misbehaving!

[Koldov]

Finally had a bit of time spare to look into this again....

 

It appears Outlook is trying to authenticate with our DC for some reason.

 

I can't really figure out why as we have no Exchange server on-site and Outlook connects to 3 separate email accounts.

 

None of them have our DC's Domain Name in the address... and it's only one of them trying to authenticate.