Forum Discussion

Haim Behar's avatar
Haim Behar
Copper Contributor
Feb 05, 2019

SAMR Queries from specific server (not computer)

Hi, One of my servers show in ATA multiple SAMR queries (see attached screen-shot). It's happening at the beginning of each our as can be seen (3:13pm, 2:13pm, etc.) Which process/network activ...
alerts
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Feb 05, 2019

A good start would be to capture a netmon 3.4 trace during the expected time of this traffic, as netmon  is usually able to show you which process generated the traffic.

By Any chance is there any software installed on this machine by Lenovo?

  • Haim Behar's avatar
    Haim Behar
    Copper Contributor
    Feb 05, 2019
    I know about the Lenovo issue with SAMR, do you know which software cause these queries ?
    & regarding the server - gonna check and get back on this.
    • EliOfek's avatar
      EliOfek
      Icon for Microsoft rankMicrosoft
      Feb 05, 2019

      So far I mainly seen it come from Lenovo.
      I think they have some kind of messaging app  that does it.
      But netmon should provide you with more clues.

Resources