Remote connection on ntfrs.exe

  • Thread starter Thread starter Edika
  • Start date Start date
E

Edika

Hi,

I've previously posted this message in the italian newsgroup but anyone answer. :-(
I have a win 2000 server with all latest updates installed.
Some days ago i've installed cports.exe a tool for monitoring the connection on the server on all the ports. I've notice that there are some connection on the service ntfrs.exe from remote clients on
the internet (usually from russians domains).
The Server is a Webserver with only IIS service and SMTP service. Is a PDC but there are no clients connected in the LAN and no other DC registered.
What are these strange connection? It could be a security problem? And why they connect to this service? It could be dangerous?
Thanks in advance

Edika
 
Do you have a firewall protecting your network? That should stop
unauthorized connections and attempts to your server. If for some reason
that is not possible in Windows 2000 you can configure an ipsec filtering
policy using only allow and block filer actions to stop access from networks
other then your subnet for ports/protocols that should not be accessed other
than by your local network.

Steve

http://www.securityfocus.com/infocus/1559 -- an example of an ipsec
filtering policy
 
Back
Top