2

I don’t know if I am hacked or what, I am running ArcGIS server 10.3.1 on windows server 2012. My server has a real domain name that can be accessed form anywhere.

The issue here is that the site admin password keeps changing and all of my service deleted after this change! I reset it but after while (hours) the password changes automatically.

Have any one experienced this issue before?

I changed the password but even it keeps changing after I change the password. I formatted the server and created new site with new usename and password. Every thing went well, till I copied the Users and roles form my backup, then I checked the carefully, there is no suspicious accounts or users, the admin group is empty. But now the password was changed again.

Improve this question
7
  • 1
    How do you know that is is "changed"? its more likely that you keep reintroducing a corrupted file back into the system everytime you copy your users back in. You probably need to start from scratch. Define what the "copy" process is. Are you connecting with an AD or LDAP? where is your data local or an NFS mount? Also if someone had your siteadmin password and they only wanted to delete your data there would be no need to create new users or accounts that's not a good metrics to identify malicious activity. Edit your question and provide the system design.
    – risail
    Commented Jan 12, 2017 at 18:45
  • 1
    @Ahmadsaleh please edit your question to include the extra information rather than posting additional info as comments
    – Midavalo ♦
    Commented Jan 12, 2017 at 18:46
  • As asked previously, are you using the built in ArcGIS Server identity store or hooked it into your Active Directory/LDAP? If the latter, check if the account is getting locked. Might be a security policy that if a process uses wrong password X times, then the account locks itself. Have seen this happen when an external script or process is trying to authenticate using that same account and locks account.
    – jakc
    Commented Jan 13, 2017 at 8:57
  • Thanks Simon, I am using ArcGIS Server Built-in roles and users. the password is not locked, because when I reset the password for the admin it gives me the old one it will be like "stuiped". it seems like a virus that changes the password.
    – Ahmad saleh
    Commented Jan 14, 2017 at 18:26
  • I would recommend either recording a quick screencast (Jing is a good tool) and replicate the problem and include a link in the question, or/and raise this with Esri support to organise a remote session. I would also work with your IT department on this one, if you suspect a virus, scan for viruses.
    – jakc
    Commented Jan 15, 2017 at 8:03

1 Answer 1

Reset to default
0

Well it seems that it a was virus or script that uses the passwordrest.bat to change the password based on time intervals (every two hours for example). I still did not figure out where the virus is, but I could stop it from changing the password by renaming passwordrest.bat to something else.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.