Re: Network Services/NT Authority
- From: "Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 12 May 2006 18:54:49 -0500
OK that is what I though in that you did not change any Group Policy
settings but instead were managing the Windows Firewall settings and no you
can not manage Group Policy on an XP Home computer. I explained in a
previous post why you are seeing network service in your security log as a
logon which is normal as your computer really is on a network - the
internet. Your best bet to find information is to probably just do a Google
search and briefly read the articles that it finds to see one that is
comfortable for your knowledge level. You might also want to go to a book
store or library and browse through some books on Windows XP to find one
that you like. It is hard to recommend one because like you said that some
assume you know a lot and other assume you know next to nothing. The Lab
Mice link below is also a great resource that I used a lot when I started
out learning more about Windows operating systems. By the way your question
was in no way a "duh" question. --- Steve
http://labmice.techtarget.com/windowsxp/default.htm
"Magsowner" <Magsowner@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:52C1BFFA-FA75-43BA-A91B-6B85E9B4B514@xxxxxxxxxxxxxxxx
On Control Panel/Security Center/Windows Firewall, there are 3 tabs. On
the
advanced tab, there are options for settings for Network Connections,
Security Logging, ICMP and then the option to reset all the firewall
settings
to default. I really don't know that much about "Group Policy" and don't
feel comfortable going in to edit those type files and I have XP Home, not
Pro, so I don't even know if I have that ability. I did get to "restore"
to
a point before I did that, so I'm back to where I was, but still don't
understand why it was showing another user logged on.
Where can I go to look up more info on some of these issues, like "Group
Policies" etc.? Microsoft's Knowledge base info is not very specific and
assumes you already have a good basic knowledge of these terms. I feel
like
such a dummy asking all these questions and I would like to be able to
look
up as much as possible before I post a "duh" question.
"Steven L Umbach" wrote:
Where exactly did you click on "Reset Defaults" ?? You need to use
gpedit.msc to access and edit local Group Policy in XP Pro. Maybe you
were
just looking at the firewall settings and not Group Policy firewall
settings? The main thing is that your firewall is still enabled.
Reset defaults is not necessarily a bad thing as long as things work as
you
want but you should be able to tweak from there. You can use the command
netsh firewall show state to see info about the firewall including if it
is
enabled. I am not sure what is going on with the other user is logged on
message. Were you possibly using fast user switching? Are the failed
logon
attempts type 2 or type 3 ?? Type three could indicate hack attempts to
user
accounts on your computer via the network which can occur if you are
connected to the internet with no firewall protection. Type 2 logons are
for local keyboard interactive logon. If you are using cable/DSL I
suggest
that you also use cheap and affordable internet router to protect your
network. You can go to a self scan site such as
http://scan.sygatetech.com/
to check for basic firewall vulnerabilities. Below is an example of a
successful type 3 network logon to computer Steve-XP from computer
server1-2003. --- Steve
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 5/12/2006
Time: 12:07:12 AM
User: STEVE-XP\Steve
Computer: STEVE-XP
Description:
Successful Network Logon:
User Name: Steve
Domain: STEVE-XP
Logon ID: (0x0,0x54D0C7)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SERVER1-2003
Logon GUID: {00000000-0000-0000-0000-000000000000}
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
"Magsowner" <Magsowner@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4CDA3A35-5164-4049-9B9F-381CEA87AFC7@xxxxxxxxxxxxxxxx
Steven: I think I just really messed things up. I tried to look at
the
firewall group policy settings to see if I could make any sense of it,
and
I
clicked on the "Reset Defaults" without meaning too. I thought I
should
go
back to my last restore point, which was yesterday, to undo it, but
when I
try to go back to the restore point it tells me that another user is
logged
on, but I am the only user that is logged on. Then, when I checked the
event
viewer it shows unsuccessful logon attempts for all users, including
the
one
I am now logged on under. Event ID's # 680 & 529 for each user.
"Steven L Umbach" wrote:
Are you finding that your firewall settings are being changed?? If you
can
post the Event ID that refers to Windows Firewall Group Policy here in
a
reply. --- Steve
"Magsowner" <Magsowner@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DDDF7FE6-7EC5-4F4E-8BAB-AD694BC7D13B@xxxxxxxxxxxxxxxx
:-I see entries in my Security Event Viewer indicating that
User: Network Services
Domain: NT Authority
is accessing my system in the wee hours of the morning with Special
Privledges assigned and then immediately followed by changes in my
Firewall
Group policy. I do not have a network, unless it is referring to my
cable
internet connection. What is Network Services and What is NT
Authority?
Should I be concerned about this?
.
- References:
- Re: Network Services/NT Authority
- From: Steven L Umbach
- Re: Network Services/NT Authority
- From: Steven L Umbach
- Re: Network Services/NT Authority
- From: Magsowner
- Re: Network Services/NT Authority
- Prev by Date: Re: Network Services/NT Authority
- Next by Date: Re: xp sp2 firewall issues
- Previous by thread: Re: Network Services/NT Authority
- Next by thread: Re: kids computer
- Index(es):
Relevant Pages
|
