Hello,
Security account manager remote protocol (SAMR) provides management functionality that is useful for manipulating an account database consisting of users, groups and other security principals. An attacker can potentially exploit this protocol to enumerate a
list of accounts and groups as shown in the ATA alert below.
An investigation should include confirming whether running scanning tools is allowed from the computer in question, and whether the account itself is permitted to do so. Its also important to investigate the source computer for unknown services or software
that maybe initiating this process.
Best regards,
Andy Liu
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact
tnmff@microsoft.com.
