Return
-
Title
Domain Controller Outbound TCP/445 Connections to Clients -
Description
While looking at the network traffic, it was found that the Domain Controllers talk Outbound to random clients (Workstations) over TCP/445 initiated from the System Process.
This was identified later to be the Change Auditor Agent
What is the reason for this traffic?
-
Cause
This is due to Change Auditor collecting data to feed the Origin field of the Events -
Resolution
This is expected comportment for Change Auditor
This uses DsrGetSiteName to collecting AD Side information for Events collection