Big Problem in Windows NT4 Server

[waleed74]

I have Big and serious problem ... actully in our Company we have old server and it's our Domain Server ,,, The OS is Windows NT4 Server with SP ver. 6A ,,, suddenly we faced problem with many users in our network .. they can't log in to the network ... after checking in the server ( Windows NT4 Server ) we didn't find some users there .... it was deleted .... !!!!

How ??? Why ??? we already have firewall and Norton Corporate Anti-Virus and we changed the password of the administrator ... but till now we didn't find the problem and ofcource we didn't find the solution for this problem ..

Everuday .. we found deleted users ... then we create it again ... everyday like this

Please ... any body have any information about this problem ... i'll be appriciate for him

Yours,

Waleed AL-Subaie

[Jason]

You might have a person within your company doing this.

[insanekiwi]

hrm. well yo usay the computer is secured. i don't think it's a hard- or software related problem.

i'm with jason.

[+BudMan MVC]

Do you have any BDC's Maybe the pdc is no longer the pdc and is only a bdc - and you are having some kind of strange sync issue where the sam is getting over written with a different copy, etc..

I would suggest you turn on auditing - and have a look see to exactly what is happening, it very well could be someone deleting accounts, etc..

[waleed74]

Dear ,,, thank you for your reply .. actully we are sure there is nobody touch the server at all because we are in front of the server ,,,, so ... i'm 100% sure there is nobody did this ....

even i put Audit on .. it will not work coz it happened it self ..

Yours,

Waleed

  BudMan said:

Do you have any BDC's  Maybe the pdc is no longer the pdc and is only a bdc - and you are having some kind of strange sync issue where the sam is getting over written with a different copy, etc..

I would suggest you turn on auditing - and have a look see to exactly what is happening, it very well could be someone deleting accounts, etc..

585148755[/snapback]

[+BudMan MVC]

huh? What does being in front of the server have to do with someone deleting accounts? It is connected to network is it not?

Um if you audit - you should know WHY it was deleted - even if the system is doing it. Once you know why, you can make sure it does not happen.

[struct]

yea ^^ turn on auditing to figure out how it is happening.