Hello!
I installed for the first time Intrust agent on Terminal Servers.
I just can't find the reason why but :
I am receiving 2 specifics alerts from all my terminal servers (hundred of times per day).
The Alerts have been causing by the server computer name itself!
Here are the alerts :
First to come is :
InTrust Major alert - Multiple failed logons by the same user.
There were 5 failed logons by user domain.com\MSTS-TAL1 from workstation MSTS-TAL1.
Alert was generated on computer msts-tal1.domain.com.
The Second Alerts is :
InTrust Major alert - Multiple failed logons from the same workstation.
There were 5 failed logons from workstation MSTS-TAL1.
Alert was generated on computer msts-tal1.domain.com
I just can't find what process or service causing that.
It's Happening every 10 minutes or so in every single Terminal Server.
What's best to do?
Is there a way to filter out the "computer": "domain.com\SERVERNAME" from this alert ?
IS IT a known false alert for terminal SERVERS that you know about maybe ?
Thanks inADvance ...
