DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding; q=dns; s=
	default; b=NYHhN8ieTwx1a5/g1+ReAJ1O734rhdmw1h6ciCOLRGZtdVgKukdea
	EAqM6x6C/AejjCEKyBqjxC+2Wb03ovE5J/uvI6QAo9Wqp2+kwxAsEimktlskHfx5
	f7wDp28vWy97Jdg8xfKcXrTlF6t5tJqjH9Wxc5kddCHT0YaPffO8M8=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
To: cygwin@cygwin.com
From: Andrew Schulman <schulman.andrew@epa.gov>
Subject: Re: thousands of NTLM requests per day
Date: Fri, 03 Mar 2017 09:50:11 -0500
Lines: 26
Message-ID: <hd0jbc1eh0mfu65gijkhjntau70oh4ajvf@4ax.com>
References: <bi4bbc1qpuhhp2pquc9ui5kfp74jj9n42b@4ax.com> <1436100995.20170228193004@yandex.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

> Greetings, Andrew Schulman!
> 
> > I got a call from our domain admins, asking me if I knew why my Windows 7
> > host would be sending many thousands of NTLMv1 authentication requests per
> > day. I don't know, and we're still trying to find out which application is
> > doing that, but here's what I wonder:
> 
> > Could Cygwin be responsible for the authentication requests? I wonder about
> > this because Cygwin now queries Windows for user and group information that
> > used to be kept statically in /etc/passwd and /etc/group.
> 
> Do you use cygserver ? If not, try to set it up, it should help with domain
> information caching. If the problem you observe is caused by Cygwin activity,
> you should see a decrease in such requests.

Thanks for the suggestion, Andrey. I'll keep it in mind for next time.

For the archive, this problem was unrelated to Cygwin. Jeffrey Altman answered
offline that "NTLM requests will be sent from the svchost.exe service when a
remote desktop connection is initiated." So I looked into the Nomachine NX
service that was running on my host, and found that it was responsible. I
disabled the service and the requests stopped.

So, not a Cygwin problem. Sorry for the noise, and thanks for the help.

Andrew


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple