Re: Network Services/NT Authority
- From: "Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 12 May 2006 00:09:39 -0500
Where exactly did you click on "Reset Defaults" ?? You need to use
gpedit.msc to access and edit local Group Policy in XP Pro. Maybe you were
just looking at the firewall settings and not Group Policy firewall
settings? The main thing is that your firewall is still enabled.
Reset defaults is not necessarily a bad thing as long as things work as you
want but you should be able to tweak from there. You can use the command
netsh firewall show state to see info about the firewall including if it is
enabled. I am not sure what is going on with the other user is logged on
message. Were you possibly using fast user switching? Are the failed logon
attempts type 2 or type 3 ?? Type three could indicate hack attempts to user
accounts on your computer via the network which can occur if you are
connected to the internet with no firewall protection. Type 2 logons are
for local keyboard interactive logon. If you are using cable/DSL I suggest
that you also use cheap and affordable internet router to protect your
network. You can go to a self scan site such as http://scan.sygatetech.com/
to check for basic firewall vulnerabilities. Below is an example of a
successful type 3 network logon to computer Steve-XP from computer
server1-2003. --- Steve
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 5/12/2006
Time: 12:07:12 AM
User: STEVE-XP\Steve
Computer: STEVE-XP
Description:
Successful Network Logon:
User Name: Steve
Domain: STEVE-XP
Logon ID: (0x0,0x54D0C7)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SERVER1-2003
Logon GUID: {00000000-0000-0000-0000-000000000000}
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
"Magsowner" <Magsowner@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4CDA3A35-5164-4049-9B9F-381CEA87AFC7@xxxxxxxxxxxxxxxx
Steven: I think I just really messed things up. I tried to look at the
firewall group policy settings to see if I could make any sense of it, and
I
clicked on the "Reset Defaults" without meaning too. I thought I should
go
back to my last restore point, which was yesterday, to undo it, but when I
try to go back to the restore point it tells me that another user is
logged
on, but I am the only user that is logged on. Then, when I checked the
event
viewer it shows unsuccessful logon attempts for all users, including the
one
I am now logged on under. Event ID's # 680 & 529 for each user.
"Steven L Umbach" wrote:
Are you finding that your firewall settings are being changed?? If you
can
post the Event ID that refers to Windows Firewall Group Policy here in a
reply. --- Steve
"Magsowner" <Magsowner@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DDDF7FE6-7EC5-4F4E-8BAB-AD694BC7D13B@xxxxxxxxxxxxxxxx
:-I see entries in my Security Event Viewer indicating that
User: Network Services
Domain: NT Authority
is accessing my system in the wee hours of the morning with Special
Privledges assigned and then immediately followed by changes in my
Firewall
Group policy. I do not have a network, unless it is referring to my
cable
internet connection. What is Network Services and What is NT
Authority?
Should I be concerned about this?
.
- Follow-Ups:
- Re: Network Services/NT Authority
- From: Magsowner
- Re: Network Services/NT Authority
- References:
- Re: Network Services/NT Authority
- From: Steven L Umbach
- Re: Network Services/NT Authority
- Prev by Date: Re: Network Services/NT Authority
- Next by Date: Re: usb ports
- Previous by thread: Re: Network Services/NT Authority
- Next by thread: Re: Network Services/NT Authority
- Index(es):
Relevant Pages
|
