SMB authorization Failure

zenlakin

Hey guys, I am curious about something that we are seeing on our network. We are seeing a ton of SMB authorization failure events and are being reporting by Cisco Mars. From the research that I have done the 2 sources are a web server and a print server. I am curious if there is a way to decrease the amount of SMB traffic on these boxes or if there might be something misconfigured that needs looked at. I am not able to directly look at or reconfigure the servers themselves as they are support by our site administrators but I am curious if anyone might have some ideas on what to have them look at? Thanks.

gojericho0

what did the authentication message failure say? Is it with a specific user account? Do you have server configured using SNARE to report the events has they happen?