Account lockout in AD – workstation Windows7, FreeRDP

I few days ago I noticed that account Administrator is locked-out few times and the source is machine called Windows7 or FreeRDP. Very suspicious, at first domain Administrator is not in use, and second the name of the machine. I have checked the security logs on the domain controllers but everything you can find there is that the Caller Computer name was FreeRDP or Windows7 and nothing more.

In order to find easily the real source I have enebled the debug logging for the Netlogon service. The steps for that:

1. Open a Command Prompt window (administrative Command Prompt window for Windows Server 2008 and later versions).
2. Type the following command, and then press Enter:

   Nltest /DBFlag:2080FFFF

3. It’s typically not necessary to stop and restart the Netlogon service for Windows 2000 Server/Professional or later operating systems to enable Netlogon logging. Netlogon-related activity is logged to %windir%\debug\netlogon.log. Verify new writes to this log in order to determine whether a restart of the Netlogon service is necessary. If you have to restart the service, open a Command Prompt window (administrative Command Prompt window for Windows Server 2008/Windows Vista and later versions of the operating system), and then run the following commands:

   net stop netlogon

   net start netlogon

And if you wan to disable it later on:

To disable Netlogon logging:

1. Open a Command Prompt window (administrative Command Prompt window for Windows Server 2008 and higher).
2. Type the following command, and then press Enter:

   Nltest /DBFlag:0x0

3. It’s typically not necessary to stop and restart the Netlogon service for Windows 2000 Server/Professional or later versions of the operating system to disable Netlogon logging. Netlogon-related activity is logged to %windir%\debug\netlogon.log. Verify that no new information is being written to this log in order to determine whether a restart of the Netlogon service is necessary. If you have to restart the service, then open a Command Prompt window (administrative Command Prompt window for Windows Server 2008/Windows Vista and later versions of the operating system), and then run the following commands:

   net stop netlogon

   net start netlogon

More detail about Netlogon here

And few minutes later I got the information I needed in the log file C:\Windows\debug\netlogon.log in this format:

05/24 11:09:52 [LOGON] DOMAINNAME: NlPickDomainWithAccount: scan: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0
05/24 11:09:52 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\scan from Windows7 (via DEV01) Returns 0xC0000064
05/24 11:09:54 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\scan from Windows7 (via DEV01) Entered
05/24 11:09:54 [LOGON] DOMAINNAME: NlPickDomainWithAccount: scan: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0
05/24 11:09:54 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\scan from Windows7 (via DEV01) Returns 0xC0000064
05/24 11:09:55 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\scan from Windows7 (via DEV01) Entered
05/24 11:09:55 [LOGON] DOMAINNAME: NlPickDomainWithAccount: scan: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0
05/24 11:09:55 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\scan from Windows7 (via DEV01) Returns 0xC0000064
05/24 11:09:56 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\ricoh from Windows7 (via DEV01) Entered
05/24 11:09:56 [LOGON] DOMAINNAME: NlPickDomainWithAccount: ricoh: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0
05/24 11:09:56 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\ricoh from Windows7 (via DEV01) Returns 0xC0000064
05/24 11:09:57 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\ricoh from Windows7 (via DEV01) Entered
05/24 11:09:57 [LOGON] DOMAINNAME: NlPickDomainWithAccount: ricoh: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0
05/24 11:09:57 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\ricoh from Windows7 (via DEV01) Returns 0xC0000064
05/24 11:09:58 [LOGON] DOMAINNAME: SamLogon: Transitive Network logon of (null)\shipping2 from Windows7 (via DEV01) Entered

In my case, a DEV machine with enabled NTLM authentication was exposed directly to Internet and someone tried to connect/hack to it.