Regresar
-
Título
Domain Controller Outbound TCP/445 Connections to Clients -
Descripción
While looking at the network traffic, it was found that the Domain Controllers talk Outbound to random clients (Workstations) over TCP/445 initiated from the System Process.
This was identified later to be the Change Auditor Agent
What is the reason for this traffic?
-
Causa
This is due to Change Auditor collecting data to feed the Origin field of the Events -
Resolución
This is expected comportment for Change Auditor
This uses DsrGetSiteName to collecting AD Side information for Events collection