[Samba] Does Samba attempt Anonymous logon to IPC$ shares? Can this lockout accounts?!?

lcea mdx lceamdx at hotmail.com
Thu Dec 19 14:18:01 GMT 2002

Hopefully someone can put my mind at ease...

I have about 10 W2K boxes with account lockout threshold of 5 failed logins 
and Additional Restrictions for Anonymous Connections set to 'No access w/o 
explicit anon. permissions' (Administrative Tools -> Security Settings -> 
Local Policies -> Security Options)

I've set up a Samba server this week and in the past few days I've noticed 
that some user accounts have been locked out (and its not just people 
forgetting their password).

In /etc/samba/MACHINEONE.log I've got entries like this:

[2002/12/17 18:17:56, 0] 
connect to client: machine MACHINEONE rejected the tconX on the IPC$ share. 

And in the W2K Security Audit for MACHINETWO, I've got:

Success Audit 18/12/2002 18:55:57 Source:Security Category:Logon/Logoff 

Unfortunately, I can't match up these two event types on a single machine 
because the logs and audits are incomplete (I've been switching the smbd log 
level and auditing isn't enabled on MACHINEONE  )

I just want to be able to track down the cause of this...


MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. 

More information about the samba mailing list