Domain administrator with several authentication attempts on DC

[Rodrigo Catarino]

Hi,We have the "administrator" domain account disabled as the best practice says.I have 200k+ daily failed login attempts from that user from my domain controller to the same machine.The logon service attempt is from krbtgt/MYDOMAIN but as the account is disabled the authentication fails.How can i validate/correct this?Kind regards,Rodrigo Catarino

Continue reading...