戻る
-
タイトル
Domain Controller Outbound TCP/445 Connections to Clients -
説明
While looking at the network traffic, it was found that the Domain Controllers talk Outbound to random clients (Workstations) over TCP/445 initiated from the System Process.
This was identified later to be the Change Auditor Agent
What is the reason for this traffic?
-
原因
This is due to Change Auditor collecting data to feed the Origin field of the Events -
対策
This is expected comportment for Change Auditor
This uses DsrGetSiteName to collecting AD Side information for Events collection