Does Vista supports Intrusion Detection

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - preventing Vista Firewall from beeing disabled by users Hi, exists a way to prevent users from disabling the Firewall built in Vista? In the group policies I found only the options to define rules for in and out going traffic but no hint for aktivating the FW. IÂ´ll be happy for any help! Thanks H. Small Tag: Does Vista supports Intrusion Detection Tag: 94555
  - 2
    - 10% Off All ChicagoCon 2007 Boot Camps for MCPs!! Hello Fellow MCPs and Security Professionals, I'm Don of the online magazine www.ethicalhacker.net. As many of you may know, we are putting on a security training event named ChicagoCon that combines a professional security conference, certification training and a hacker con into a single, unique event from Sept 17 - 23, 2007. Our ECC courses are provided by an ECC ATC of the Year, CISSP is endorsed by ISC2 with the exam on site, Linux+ is being taught by the author of "Linux for Dummies", Expert Pen Testing by Jack Koziol of the InfoSec Institute... and the list goes on!! I know it's last minute, but now that the early registration discount deadline has passed, we are now able to offer discounts to communities such as this one. So I am pleased to be able to offer a 10% off any course to portal members if they contact me directly at don@digitalconstructionco.com. Courses Include: - Breakfast, lunch and most dinners - All study materials, computers and your certification exam - All keynotes, presentations and events. Sorry... because of space restrictions, only paid attendees are allowed. In the tradition of the Ethical Hacker Network, we love free giveaways, so each attendee will receive a bag full of FREE STUFF including books, t-shirts, magazines, an EH-Net version of BackTrack2 (with Metasploit 3 and packaged as a VMware Virtual Appliance) and more. Course Offerings: Management PMP/CAPM - Project Management SOX/COBIT - Compliance CISSP -- Security Management (7-Day Course) Beginner Ethical Hacking Fundamentals (Network+/Security+) Linux+ - Open Source Operating System CCNA - Cisco Certified Network Associate Intermediate CEH (CNDA) - Certified Ethical Hacker CHFI - Certified Hacking Forensics Investigator SNPA -- Securing Networks with Cisco PIX / ASA Advanced CEPT - Certified Expert Penetration Tester Web Application Hacking Keynotes by: John C. Dvorak - PC Mag Steve Hunt - Industry Analyst Lance Spitzner - Founder of the Honeynet Project Doug Steelman - DoD GIG (Global Information Grid) Dean Turner - Symantec's Director, Global Intelligence Network Evening Presentations (similar to Black Hat) Include: Live demos of Metasploit Live demos of Cain & Abel Malware Analysis in Front of your Eyes eVoting Myths Debunked Blackjacking author Dan Hoffman For more detailed info, visit www.chicagocon.com. Remember, you MUST contact me directly to get your discount!! I'll see you in Chicago, Donald C. Donzal, CISSP, MCSE 2003, CEH, Security+ SME don@digitalconstructionco.com Tag: Does Vista supports Intrusion Detection Tag: 94554
  - 3
    - Which is more secure Outlook or Hotmail? Outlook which has certificates encryption and signing seems very private and secure. Are there any vulnerability points between me and recipient of my email when I use Outlook to encrypt and sign? How does Hotmail compare security and privacy-wise with Outlook? Tag: Does Vista supports Intrusion Detection Tag: 94550
  - 4
    - mixed authentication and LogonUser token in forms ticket - safe? Hi I've implemented a mixed forms/windows authentication solution loosely based on the following example http://www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=a12e9f53-695f-452f-87d0-abbe9f12351e - an overview of this is as follows: IIS has anonymous access enabled and also has windows integrated authentication enabled my web.config has forms authentication on and impersonation off In my global.asax.vb I handle FormsAuthentication_Authenticate and if the user is authenticated via windows auth on the browser's user, I construct a windows principal for the forms authentication to use based on the following windows identity: Dim ident as WindowsIdentity = New WindowsIdentity(request.GetUserToken(), authType, WindowsAccountType.Normal, True) If the windows authentication fails, the user is kicked to forms authentication and must sign in. I validate their password against the domain via a Win32 call to LogonUser(). The result of this is an IntPtr to a user handle if supplied credentials are valid. I call CloseHandle() on this and return the IntPtr, which I then stick in the forms cookie's user data: ' COM interop functions Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal lpszUsername As [String], ByVal lpszDomain As [String], ByVal lpszPassword As [String], ByVal dwLogonType As Integer, ByVal dwLogonProvider As Integer, ByRef phToken As IntPtr) As Boolean Private Declare Auto Function CloseHandle Lib "kernel32.dll" (ByRef handle As IntPtr) As Boolean ' COM constants Private Const InteractiveLogon As Integer = 2 Private Const DefaultProvider As Integer = 0 Public Shared Function AuthenticateAgainstDomain(ByVal domain As String, ByVal username As String, ByVal password As String) As IntPtr ' Dim handle As IntPtr = IntPtr.Zero Dim logonSucceeded As Boolean = LogonUser(username, domain, password, InteractiveLogon, DefaultProvider, handle) If Not logonSucceeded Then Dim errorCode As Integer = Marshal.GetLastWin32Error() LogException(ExceptionType.AuthenticationError, String.Format("Unable to logon user. Error code {0}.", errorCode)) End If CloseHandle(handle) Return handle End Function When the forms ticket is presented by an authenticated user during Application_AuthenticateRequest event, I extract the IntPtr user token and construct a windows identity from it: Dim authcookie As HttpCookie = Request.Cookies(FormsAuthentication.FormsCookieName) Dim ticket As FormsAuthenticationTicket = FormsAuthentication.Decrypt(authcookie.Value) Dim token As IntPtr = New IntPtr(Integer.Parse(ticket.UserData)) Dim ident as WindowsIdentity = New WindowsIdentity(token, "NTLM", WindowsAccountType.Normal, True) My question is this: obviously, this works in my test environment but is this safe in production? Can the IntPtr handle be relied on or will it be released at some unspecified point in the future? Regards Iain Tag: Does Vista supports Intrusion Detection Tag: 94548
  - 5
    - Account Lockout Policies My apologies if I'm not posting in the correct newsgroup. My question is if there's a way to set up a security policy on Windows 2003 DC which is lockout or disable a user that dosn't log into the domain for a specified amount of time. For example a user that hasn't logged into the domain for 30 days will be locked out??? Thanks Tag: Does Vista supports Intrusion Detection Tag: 94539
  - 6
    - Yellow Shield system tray icon I've had a few times when the yellow shield icon will appear for just a moment upon startup. I have a feeling it means nothing. When it's time for auto updates, that shield icon works normally for me. Tag: Does Vista supports Intrusion Detection Tag: 94537
  - 7
    - Access denied on Homeshare with FQDN, fine with Shortname I'm getting a strange error where I am getting an access denied on my homeshare. But only when using FQDN to define my server. If I change from \\servername.domain.local\homeshare$ to simply \\servername\homeshare$, everything works. This is only happening on some Vista machines that are in the same OU as the other Vista machines. This problem does not manifest itself on XP. Any ideas why Vista doesn't work with FQDN defined homeshares.... or at least on SOME of my machines? NOTE: I can also *fix* this problem by leaving it an FQDN, but changing from user-specific to Everyone or Authenticated Users on the Share ACL. Well, that's not really fixing it.... Tag: Does Vista supports Intrusion Detection Tag: 94533
  - 8
    - PKI User Certificate on Smart Card auto renewal ? Hello I'm using a Enterprise issuing CA with an enrollment Station to issue smart card certificate on behalf of users. everything works fine. now i'm not sure how to enable and configure the environment to make an automatically renewal of the certificate on the smart card, without the user visiting the Enrollment Agent. Is it only necessary in the template, or do i have to configure a group policy to initiate the renewal proces`s ? Thanks, -- ~~~~~~~~~~~~~~~~~~~~ ..is an MCSE 2003 and MCDBA ~~~~~~~~~~~~~~~~~~~~ Tag: Does Vista supports Intrusion Detection Tag: 94532
  - 9
    - Patches installed during shutdown I just received update 933360 through Autoupdates. The yellow shield near the clock as usual and I wasn't sure why I was getting updated. Nothing happened for 10-15 minutes and then it said it would install the patch during shutdown, which it did. I understand this is because I shut down after the loading and before the installing of the update. It's only installed updates this way one time before. My autoupdate time is set for 3AM. Why did it install that way? Tag: Does Vista supports Intrusion Detection Tag: 94529
  - 10
    - Patches installed during shutdown I just received update 933360 through Autoupdates. The yellow shield near the clock as usual and I wasn't sure why I was getting updated. Nothing happened for 10-15 minutes and then it said it would install the patch during shutdown, which it did. I understand this is because I shut down after the loading and before the installing of the update. It's only installed updates this way one time before. My autoupdate time is set for 3AM. Why did it install that way? Tag: Does Vista supports Intrusion Detection Tag: 94528
  - 11
    - IE bypasses Zonealarm I have Zonealarm Version 7 and use Opera and Firefox exclusively on XP. However recently I brought up the IE browser which is hidden in Wordpad. ( Click Help Topics in Wordpad, Click the Question Mark top left and click jump to URL) I was able to connect to www.aliceinvideoland.co.nz and use its search functions( even though there was a specific block on " Mobile code" Zonealarms name for a mix of Javascript, vbscript, Java and Active X) Opera and Firefox were unable to get through this block to operate the search function as one would expect. When this block was removed Firefox and Opera could then access the site to use the search function. This implies that this embedded IE is able to do an end run around firewalls even though the Firewall is specifically set to black code from a specific site. I must admit to be most unpleasantly surprised when IE broke security in this fashion. Tag: Does Vista supports Intrusion Detection Tag: 94525
  - 12
    - MSRootkit revealer & trustworthy applications Hi, We developped a product that uses file filters to hide specific internal files. Our internal files are hidden for other applications. The (very good) tool MSRootkit revealer shows these files, and so displays warnings. This is normal. My question is : is there a way for this tool to consider specific applications or files to be trustworthy applications, and so that it displays no warnings ? For example our product could be signed by MS, or something like that. thanks J. Tag: Does Vista supports Intrusion Detection Tag: 94521
  - 13
    - SSL not trusted Hello, I created 2 tier CA infrastructure - ofline root CA, and domain joined subordinate CA. I created certificate and installed it on web server. When someone visits our page, gets message that certificate is not trusted, if i try to install certificate on the client in IE, it finishes with success message. But next time when i visit same site, server certificate still not trusted, if i install root CA certificate on client, then it is ok. The Question - How i can create certificate that could be trusted simple by installing web servers certificate and will that certificate work with mobile devices (ActiveSync). -- Muson Tag: Does Vista supports Intrusion Detection Tag: 94517
  - 14
    - programer problem windows defender said that FREDOME.EXE might be causing a problem on my computer. I know that this is some sort of security program. I have BellSouth internet security. But can not find any info on this program. Any suggestions? -- Maggie Tag: Does Vista supports Intrusion Detection Tag: 94514
  - 15
    - zlob removal please help HI my computer appears to ahve been infected with zlob.................pc-cillin does not find it howerver, nor does housecall........ symptoms are popups that take us to a download site for virus removal software....these pop up all over the place and to close down your have to click a second pop up to release them....... I have a flashing security symbol in the right hand corner of the toolbar on desktop that keeps popping up infomfing me i have spyware and need to download programs to remove. I looked zlob up in the wikipedia and follows instructions there to down load spyhunter.................spyhunter finds at least 20 problems each time its run, supposedly removes them but the next scan shows almost as many..........i also followed the manual removal instructions but still have the security icon in the tray flashing at me............... spyhunter scan last night showed no infections, cookies etc...............started up this morning and checked the bank and now i hvae bloody zlob showing again........ Is it as dangerous as it sounds???? Can someone please help me remove it????? a program that is trustworthy or a mnaual way to delete???? I also used an online scan of avg as suggested but that showed nothing........................very confused................comp is definatley doing some strange stuff but half the virus scans i used have found nothing and spyhunter finds well over 20 each time usually.................even after manual removal. PLEASE help if you can??? THanks Zoe Tag: Does Vista supports Intrusion Detection Tag: 94510
  - 16
    - CA's and Certificates for MOM or System Center OM I am having some difficulty understanding and configuring CA's for monitoring ofdomains outside the trust realm. I have loaded Microsoft's Certificate Services, and in reading the instructions have tried going to http://<computername>/certserv but page cannont be found. I am not opposed to using Verisign or Thwate, but not sure what I need. I am running Windows Server 2003 R2x64 Standard. Tag: Does Vista supports Intrusion Detection Tag: 94509
  - 17
    - windows security alert says kaspersky is turned off I have a daily message on my taskbar from windows security that my Kaspersky Antivirus is turned off. But when I go to my Kaspersky program, all systems show that it is running. I don't know if this is related to the problem or not, but I recently upgraded from kaspersky antivirus 6 to kaspersky antivirus 7. I did not uninstall 6 first. The program may have done it itself, though. I would like to know for sure if my computer is protected or not, and if there is a way to make the message on my taskbar go away. I wrote Kaspersky a few days ago and they have not responded. Thanks Jesus Loves You :-) Tag: Does Vista supports Intrusion Detection Tag: 94494
  - 18
    - Reliable way to detect presence of macros What I'm looking for is a reliable way to detect the presence of macros in Word 6/7/97/2000/2003 documents. Would help if this could be done for Excel workbooks too, but not essential. I don't need to know what macro names, or what code they contain, just if macros are present, true or false. That way I can code a (hopefully small) executable to detect them. This is to implement a mailserver policy for a distribution-list that needs to send Word documents, to ensure no macro-based malware gets through. Does anyone know of any relevant Technet articles or code examples? Tag: Does Vista supports Intrusion Detection Tag: 94492
  - 19
    - Computer Access As an intermediate user I have a question on accessing my computer. Is there a log I can check somewhere on my pc which will show when it was switched on, accessed etc? I know my internet history was cleared by someone else but I can't confirm when it was used. Any ideas? Tag: Does Vista supports Intrusion Detection Tag: 94483
  - 20
    - User account lockout connecting to Exchange Hello, We have the following scenario: XPSP2 home PC not on domain Cisco VPN Exchange 2000 Outlook 2007 User logs on locally to home machine, then connects through VPN, opens Outlook which prompts for domain credentials, which he has indicated he is sure he has typed correctly (and webmail works no problem). Account then locks out. Account is enabled and not expired. Does anyone have any suggestions, Google didn't turn up much. Tag: Does Vista supports Intrusion Detection Tag: 94476
  - 21
    - OneCare forums This web site for OneCare forums does not seem to exist on my IE7 browser for XP2. I have accessed it many time before July, but not recently. What happened. http://forums.microsoft.com/windowsonecare/default.aspx?siteid=2 -- Robert Tag: Does Vista supports Intrusion Detection Tag: 94471
  - 22
    - ms capi to openssl Hello , I am having RSA Public & Private keys & encrypted data on windows machine. Both generated with Ms Capi. I want to decrypt the data on linux using openssl. [1] So how do I move the private key from capi to openssl ? Do I need to change endian ness for private key ? What do u exactly mean by changing endian-ness ? It is complete reversal of bytes or just swapping of bytes within word. [2] Before decrypting a data , do I need to reverse the bytes ? What should I do , I am badly stuck . Currently its a nightmare for me to get this working. Thanks, - Bhaskar. Tag: Does Vista supports Intrusion Detection Tag: 94468
  - 23
    - KB937143 has killed my server side ActiveX controls... Why? Hello, I have an old ASP application that uses server side ActiveX controls called from serverside javascript. MS Update KB937143 has made it so these no longer work. Does anyone know why, or have any idea how to correct this (other than un-installing KB937143)? Uninstalling does resolve the problem, by the way. I just want to know what this update changed so I can fix my problem. Thanks! Tag: Does Vista supports Intrusion Detection Tag: 94440
  - 24
    - Account should be locked out.....but isn't! Hi I am security auditor for a Windows 2003/2000 mixed-mode domain. Client workstations are XP SP2, and all domain controllers are 2003 server. The default domain group policy defines the account lockout policy at a threshold of 6 failed logons. Recently I have noticed a large number of failed logons for a user who has Domain Admins membership. With 1154 failures in 2 days, I would have expected the account to have been locked out but it isn't. The failures are all 529/Type 3. I have checked for settings that block inheritance of the default domain policy but there are none. How can the account have failed logon so many times and not triggered the lockout? Tag: Does Vista supports Intrusion Detection Tag: 94438
  - 25
    - Which Registry Values store these Windows Firewall GPO settings...... In PolicySettings.xls - a spreadsheet that lists all GPO settings , some settings have multiple registry value paths associated with them. In GPO Editor , when enabling these settings , a user must specify more than whether the setting is Enabled/Disabled . Are all these registry paths required to store 1 Windows Firewall GPO Setting ? For instance:: 1.For the policy setting - Windows Firewall: Allow remote administration exception; there are 2 registry values associated : HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile \RemoteAdminSettings!Enabled, HKLM\SOFTWARE\Policies\Microsoft \WindowsFirewall\DomainProfile\RemoteAdminSettings!RemoteAddresses Are both neccessary for the GPO setting to be Enabled. To determine if the setting is Enabled, isn't the first 1 sufficient? Similar case for : Windows Firewall: Allow file and printer sharing exception Its 2 registry values are: 1] HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile \Services\FileAndPrint!Enabled, 2] HKLM\SOFTWARE\Policies\Microsoft \WindowsFirewall\DomainProfile\Services\FileAndPrint!RemoteAddresses If the 1st Registry value is set to enabled, is it neccessary to check for the Address List.What will the behaviour be , if only the 1stregistry value is present? 2. On enabling the Logging setting in gpedit.msc , 2 registry values get created - LogFileSize & LogFilePath & on disabling the setting, both registry values get deleted If 1 registry value say LogFileSize is deleted, is Logging enabled/ disabled effectively? In GPO Editor, the setting before the value was deleted is maintained.i.e. To check if logging is enabled using a script, are the values of both registry values[LogFileSize & LogFilePath] required? Tag: Does Vista supports Intrusion Detection Tag: 94415
- Next
  - 1
    - Updated critical patches and rebooted server (server did not reboo Hi, I applied couple of critical patches from April till now as the previous admins did not install any of these patches. But, one of my domain controller (which holds the Global Catalog) was rebooted after the patch install. Reboot command got issued, but it did not time out when I tried pinging with a -t for almost 30 minutes. So, I thought something is wrong. I tried RDP in again and could not. I have noticed this RDP problem cropping up from sometime in October of last year, when I applied patches and after that I could not RDP onto the server. I will have to reboot the server twice to get in through RDP again. Well this is not my main concern, but my main concern is the above problem. I am not physically at the site to look at the server what is going on with my Domain Controller, which I might go in tomorrow to work or on Monday morning if nobody calls in with login issues, I might reboot the server again. If anybody could let me know why all the domain controllers rebooted and this one did not. I have couple of event logs which I can throw it in here, if needed. thanks in advance Tag: Does Vista supports Intrusion Detection Tag: 94411
  - 2
    - Security risk when going on line to reinstall antivirus prog. McAfee antivirus has blocked a program from sending emails from my computer because of activity which might indicate a worm is on my computer. To remedy this problem McAfee have asked me to uninstall and then reinstall McAfee from my on line account and not from the installation CD. I pointed out to McAfee that I was concerned that if there is a worm on my computer it could run riot after I uninstall the the McAfee Security center and then go online unprotected in order to carry out the reinstallation. The reply I got From McAfee was: "I would suggest you to please uninstall McAfee with the help of removal tool and reinstall from your online account and not from the CD." That reply has not allayed my concern. I have scanned my computer with McAfee AntiVirus which (although the block in Windows Mail is still in place) is currently reporting only 6 Potentionally unwanted Programs and adds that no action is required. Also Spybot gives a clean bill of health. AD-Aware reports a couple of MRU objects which I have quarantined on a number of occasions but they keep returning. The only program that has caused me a little concern is a-Squared Free which reports: Trace.directory.ebay 1 traces - med. risk (trace C:\program files\ebay\ebay toolbar 2) and Trace.file.ebay 2 traces--med risk (Trace:C:\program files\ebay\ebay toolbar 2\ebaytb.dll) McAfee has asked me to remove all the third party programs from my computer. My McAfee account is paid up to May 2010. Is it safe for me to proceed with the instructions I have been given by McAfee? Thank you Tag: Does Vista supports Intrusion Detection Tag: 94409
  - 3
    - How to get rid of an unwanted homepage? Somehow or other, while browsing, my wife accepted some kind of download from a site called websecurity.com. Apparently, their ad came up as a pop up, saying that our computer was under some kind of virus threat. As a result, settings have been changed, making this site our homepage and we are unableto change it. Tried going to internet options but cannot change homepageand or get rid of their icon on our toolbar Can anyone help? Thanks Alana Tag: Does Vista supports Intrusion Detection Tag: 94406
  - 4
    - Wex Tech Answerworks - How can I deinstall it? Found this one too and it won't let me to a remove from the control panel. Help ! Tag: Does Vista supports Intrusion Detection Tag: 94391
  - 5
    - How can one tell if MRT is legitament or not ? I found MRT*.* in folder titled "bdd19dcc3d813ebf6013b85177b8" Searching Goggle says it is a Virus/Malware. Others say its part of MS program. Which is correct ? And if it's a Virus/Malware how to I get rid of it? Tag: Does Vista supports Intrusion Detection Tag: 94390
  - 6
    - fingerprint scanner with multiple users I just got a microsoft keyboard wtih fingerprint scanner but multiple people use it. Is there any way to store information for multiple people or just one person per computer/scanner. Tag: Does Vista supports Intrusion Detection Tag: 94387
  - 7
    - Windows Firewall I can't turn my "Windows Firewall" on, the check boxes so i can turn it on are faded and so are the words right next to the boxes or circles. There is a check next to Off (not recommended) though. But i want to turn it on but i can't. Tag: Does Vista supports Intrusion Detection Tag: 94386
  - 8
    - Protecting e-mails I work for a church that often deals with sensitive/personal issues that could have a great deal of liability involved if such messages are not handled properly. I thought this used to fall under the category of DRM, but this seems to have been comendeered to pertain to mostly music. I have never dealt with these issues before, so I am unaware of how to set this up. First, is DRM the appropriate terminology? More importantly, how do they begin makinging e-mail flagged as non-printable, non-forwardable, etc.,? They are running Windows SBS 2003 with all service packs applied, Exchange 2003 Server, and run Outlook 2003 on our workstations. Does the process begin on the server, or does it begin at each worstation? Is/are there (a) white paper(s) that discuss how to set this up? Anyone want to express their opinion or describe their experience in working with this? -- Gerald A. Wooten Phaser Computers Tag: Does Vista supports Intrusion Detection Tag: 94385
  - 9
    - An NTE_BAD_DATA error returned by CryptDecrypt() Hi, May I ask a question about an NTE_BAD_DATA error returned by CryptDecrypt()? I am working on an application of SSL client/server connection using Microsoft Certificates and Crypto API. I'm running Windows XP. Currently the SSL connection between my client and server works, but when I use IE 6.0 (SSL 3.0/TLS 1.0) to connect to the server, the server failed with an NTE_BAD_DATA error at CryptDecrypt(). This is the step where the server tries to decrypt the pre-master secret encrypted by IE. In my own client code, I use CryptEncrypt() to encrypt the pre-master secret with the server's public key. Not sure if IE uses the same functions.. Below I've included all the functions I called to decrypt the encrypted message in the server side: (1) CryptAcquireContext(&hProv, mcskp->szKeyContainerName, mcskp->szProvName, PROV_RSA_FULL, 0); (2) CryptGetUserKey (hProv, AT_KEYEXCHANGE, &hKey); (3) CryptDecrypt(hKey, 0, TRUE, 0, (BYTE *)tempbuffer, &tempbufferlength); <--- FALSE was returned here, and NTE_BAD_DATA (80090005) was reported by GetLastError(). * I've tried four CSPs, but I got the same error in all of them: "Microsoft Enhanced Cryptographic Provider v1.0", "Microsoft Strong Cryptographic Provider", "Microsoft RSA Schannel Cryptographic Provider", and "Microsoft Base Cryptographic Provider v1.0". * The pre-master secret is supposed to be of size 48 bytes, so setting the Final flag as TRUE should be correct. Because NTE_BAD_DATA indicates that the data to be decrypted is invalid, I logged the value in 'tempbuffer' as below. ('tempbufferlength'==128) 5F EB 8C 0B D7 C2 7C C0 94 8F F9 0F 85 33 30 86 73 B6 DA BA 11 E3 93 AE 3C 02 28 56 E5 06 B4 49 83 2F 44 1B C5 CF C0 21 95 BC 53 0B 03 1C 49 C9 49 0F A6 69 B8 E1 22 9F 04 A2 08 68 43 63 9D 69 53 57 79 C9 FE 5C 02 72 BB 4F 1B 7D EF EB 16 53 E3 62 1A C0 83 D4 71 C5 89 52 E9 1D FE 65 DB C4 CE 33 75 F1 D0 54 E0 87 59 14 43 E5 5E 1C C6 49 62 A7 D4 EC 67 D4 73 7C BB 5F F5 FB 08 EA AC 62 I intended to check why it's invalid using the server's private key, but I don't know how to print the value of a HCRYPTKEY variable or how to learn it from the certificate. I created the user certificate and its trust point, a self-signed certificate, by the following commands: * makecert -pe -n "CN=Trusted" -r -b 08/01/2007 -e 12/31/2010 -sp "Microsoft Strong Cryptographic Provider" -sky exchange -ss ca * makecert -pe -is ca -in "Trusted" -n "CN=User" -b 08/01/2007 -e 12/31/2010 -sp "Microsoft Strong Cryptographic Provider" -sky exchange -eku 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2 -ss my May someone kindly advise what could be the problem in my case? Your help would be much appreciated. Thanks, Sean Tag: Does Vista supports Intrusion Detection Tag: 94383
  - 10
    - ActiveX controlls blocked on IE Windows XP Home SP2 AVG antivirus, Windows firewall. When browsing pages with ActiveX controlls the IE information bar reads: "Your security settings do not allow Web sites to use ActiveX controls installed on your computer. This page may not display correctly. Click here for options." Clicking on the bar, the ONLY option available is Help. The option to install or allow ActiveX controlls is not there. I have tried everything I could find here and on the net to fix this problem and nothing works. Reinstalling XP is NOT an option. The PC is 100% free of malware and completely up to date (WindowsUpdate works just fine as you may notice). Creating a new user account does not fix the problem, the blockage is machine-wide. Help is needed ASAP! Thank you for your reply. -- "There are no shortcuts to a job well done" A+, Network+, MCDST Certified Technician. Tag: Does Vista supports Intrusion Detection Tag: 94376
  - 11
    - Password protect files that can be edited As a security measure, I placed all of my financial files in a zipped compressed folder and protected the folder with a password. Now I find the files have been changed to Read-Only and, as such, they cannot be brought up to date, or edited. I have not been able to change the file properties, and do not know of any procedure to follow to edit a file other than remove the password protection, edit a file, and then go through the procedure of compressing and password protecting the file again. Does anyone have a more realistic solution to protecting the privacy of sensitive files while maintaining an easy method of editing? -- Robert Tag: Does Vista supports Intrusion Detection Tag: 94374
  - 12
    - Assign USB ports to user's session Windows XP I need to know, if is possible assign one USB port to user's session Windows XP. I have this question because need restrict some user's account for use webcam. If this is possible, how I do it? I REAFFIRM, I don't like to restrict or disable access the ports (http://support.microsoft.com/default.aspx/kb/555324), I need only ASSIGN "X" USB port to user's session windows xp Any help is highly appreciated. thanks in advance. Bladimir Gambin Santa Marta - Colombia Tag: Does Vista supports Intrusion Detection Tag: 94372
  - 13
    - Phishing We just received new laptop with Vista Home Premium. It also had Norton Internet Security 2007 installed. Now get two pop-ups. The one from NIS reads: Norton Internet Security is not currently your default phishing filter. Would you like to make it your default phishing filter? YES NO (Don't ask me again.) ======= I've also received a pop-up from MS stating something to the effect: "Turn ON automatic Phishing Filter Turn OFF automatic Phishing Filter" I just close (X) the box. Which one should I choose? The MS or NIS filter to click "YES" to? Does anyone know? Tag: Does Vista supports Intrusion Detection Tag: 94371
  - 14
    - Fingerprint Reader Not Recognizing Log In Pages. I really like this gaget (Microsoft/Biometric Reader), but I find it does not recognize certain sites' log in pages. On these sites, there are no other screens to log in on. Is there any way to work around this problem? Thanks Tag: Does Vista supports Intrusion Detection Tag: 94368
  - 15
    - tracking copy transaction Hi Is there a way to track "copy" transaction (copying of files) from one folder to another folder. I'm trying to trace who had copied files from a shared folder (only 1 user was granted read/write access to this folder) to a public folder in Win2003 server. This user who had been granted access to the shared folder advised that he did not copy it to the public folder, thus someone had illegally access his folder and copied those confidential files. we tried viewing the app/system/security logs from event viewer but it doesn;t help much. Thanks for any advice. -- asterisks~ Tag: Does Vista supports Intrusion Detection Tag: 94362
  - 16
    - using WSUSSCN2.CAB Hello, I am trying to find a way to obtain the list of patches and security updates that should be installed for specific Microsoft operating systems and applications. It has to be some sort of list, which depending on the operating system or application given, it brings the list of patches or updates that should be installed. I would like to know if this information can be obtained from the WSUSSCN2.CAB file and how. The KB article 927745 brings some information on this issue, but I find it quite cryptic and incomplete. Using MBSA and MBSACLI are not an option, because they both require administrator rights. Thank you for your attention! Tag: Does Vista supports Intrusion Detection Tag: 94361
  - 17
    - mrt.exe I just did autoupdates along with the Malicious Tool thing. I found an mrt.exe on my C drive but it's dated 8/2/07. Is that normal? Tag: Does Vista supports Intrusion Detection Tag: 94355
  - 18
    - Malicious Software Removal Tool - signs that it was running I just did autoupdate and included the removal tool for the first time. Did it run while loading all the other updates? It's supposed to, but I expected it to take longer, since it scans the whole disk, doesn't it? But the whole update took, as usual, only 5-10 minutes. Tag: Does Vista supports Intrusion Detection Tag: 94354
  - 19
    - System Crash and Data Recovery Anyone here knows how to recover data from a backup NTFS drive? I use the drive to back up my data. However, after system is crashed and reinstalled, some files is not accessible anymore. I found some file saved a few months ago is ok. Those saved recently are not accessible. I am not sure what setttings have been modified. Appreciate the help to let me know how to recove the data. Tag: Does Vista supports Intrusion Detection Tag: 94353
  - 20
    - Unable to log on - Unknown Admin Password Hi To explain the situation, we currently have a Windows Storage Server 2003 R2 which has been reporting errors of â??Windows cannot determine the user or computer nameâ??. This has been experienced previously and overcome by adding the server to a Workgroup, rebooting, logging on to the server locally, then reconnecting the server to the domain. However, unfortunately the particular server in question was configured by a contractor who, predictably, never gave us the local password. Therefore I currently have a Storage Server which is no longer on our Windows 2000 domain and which I am unable to log onto to reconnect to the domain. As i'm sure you will agree it is a bit of a problem! So my questions are: a) is there any way to reconnect the server to the domain without logging on locally? b) if the answer to the above is no, what is the best way to recover the local administrator password? c) Any other suggestions? I would be very grateful for any advice anyone could give me with this. Many thanks James Tag: Does Vista supports Intrusion Detection Tag: 94350
  - 21
    - Microsoft PKI problem with domain controllers (autoenrollment) Hello everybody, I have the following problem on my AD-Domain (3 Domain Controllers with MS-PKI): all the domain controllers have recurrent errors in the Application Event Viewer that say: "Automatic Certificate Enrollment for local system could not find a valid certificate templete to match DomainControlleras specified in the group policy automatic enrollment object. Enrollment will not be performed." The "DomainController" template is the standard template, which I have removed from the "Certificta templates to issue" container. Besides, I have created a new personnalized DomainController template, called MyDomainController, which is accepted by all the CDs, i.e. all the 3 of them have been issued a valid certificate. Nevertheless, all domain controllers still ask for a "DomainController" Certificate, although there is no entry at all in the Default Domain Controller Policy (--> Computer Settings --> Windows Settings --> Security Settings --> Public Key Policies --> Automatic Certificate Request Settings). If I try to reintegrate the "DomainController" template on the CA to -- > Certificate Authority --> My CA --> Certificate Templates: New Cert Template to issue, I get the following error: "The template information on the CA cannot be modified at this time. This is most likely because the CA service is not running or these are replication delays. One or more certificate templates to be enables on this certificate authority could not be found. The changes can be saved to Active Directory and retrieved by the CA next time it is started. Do you want to save the changes to Active Directory?". Clicking "Yes" and restarting the CA does not solve the problem... Did anyone have the same problem? Any ides? Thanks in advance, Grovnasch Tag: Does Vista supports Intrusion Detection Tag: 94349
  - 22
    - To prohibit creation or access of a particular file type? Hi all, Is there any way in Windows XP to prohibit user from creating and accessing a particular file type like ".mp3"? if not, is there any third party tool to do it? Thank you, Samuel Tag: Does Vista supports Intrusion Detection Tag: 94346
  - 23
    - Malicious Software Tool - is it worth it? I've never downloaded or used the Windows Malicious Software Removal Tool. I download the patches every time and I use AVP antivirus and Spybot (I use XP SP2). Should I bother with the Removal Tool? Tag: Does Vista supports Intrusion Detection Tag: 94334
  - 24
    - Cannot Uninstall Windows Defender I go into add/remove programs and try to unistall windows defender and it say it cannot find windowsdefender.msi and asks me for an install disc. I searched my machine and the file does not exist. This is a real problem because I am trying to install Norton 360 and it says I must uninstall windows defender first. I only briefly used the beta version and somehow after beta expired some files were deleted or corrupted. I also tried to install new version of windows defender but I get the same error message about file not found and I need to use install disc. Tag: Does Vista supports Intrusion Detection Tag: 94332
  - 25
    - Removing viruses from another hard drive. Hi I have spent days and days trying to find an answer to the following. I have run antivirus/malware programs for years on my machine and most of the time keep it reasonably clean of bugs, so I know all about removing stuff from a live, connected to the internet computer. What I would like to know is, how does one remove viruses from a second computer which has no internet, or an ineffective antivirus/malware. Is it possible to slave the hard drive to an up to date computer and scan from there without collecting all the bugs from the slave drive? Or does one have to setup antivirus programs on the infected computer and update manually. However what happens if it is dead, and cannot start due to the infection. I know this is probably basic stuff but any help would be appreciated. Wombat -- Eats, roots and leaves. Tag: Does Vista supports Intrusion Detection Tag: 94330

Hi again,

an other question ... Does Vista support Intrusin detection with native
tools e.g. Firewall?

Thanks for your help!
H. Small

Top

Re: Does Vista supports Intrusion Detection by S

S
Sat Sep 01 20:33:53 PDT 2007

Define "intrusion detection" please?

Intrusion detection is traditionally defined as either network (NIDS) or
host-based (HIDS). NIDS analyses network traffic and alerts on suspicious
acivities. Vista doesn't have NIDS but you can run NIDS on Windows. Snort
(www.snort.org) is free and runs on Windows.

HIDS analyses files and system calls for suspicious activities. Windows
Defender has features of HIDS.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

"h.small" <hsmall@discussions.microsoft.com> wrote in message
news:01D6BB89-43F2-4CB6-80F0-D56D92339E5D@microsoft.com...
> Hi again,
>
> an other question ... Does Vista support Intrusin detection with native
> tools e.g. Firewall?
>
> Thanks for your help!
> H. Small

Top