Event ID 675

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Security vulnerability scanner We have one-place branch office and we'd like to create security analysis of our services, checking procedures and make new procedures and rules. As first step we'll run Microsoft Best Practices Analyzers (for Exchange, GPO, SharePoint, SystemStateAnalyzer, ...) and follow Microsoft Instrastructure Optimization to identify our currently position in IT software and hardware world. Can you please advice any other SW / procedure to follow formal procedure and any security vulnerability scanner to check our network? Thnx. Tag: Event ID 675 Tag: 99215
  - 2
    - Microsoft's New Program --- MAPP Will the vulnerabilities be available to security researches 3 days or less in October as scheduled for MAPP or is this scheduling still all up in the air where Microsoft chooses one of 3 points in how a patch may affect a user and/or business. I imagine you want users that work in the electronics industry and are focused on external security and internal safety issues. Please Steve Riley can you go into any more detail(s) about the upcoming Microsoft program to better educate your users and I could find only limited information about it on the 'Net where say an example was given that a business might want to first patch vulnerability 3 which let us say is moderate given its exploitability of high vulnerability in the attack vector once the patch and associated information are sent out to the public compared to vulnerability 1 which is critical but has a low exploitability rating. Tag: Event ID 675 Tag: 99214
  - 3
    - security certificate error All of a sudden I am getting "content was blocked because it was not signed by a valid security certificate"...I am having it happen on all sites I have used and trusted including this site. Can anyone help me w/this? I am using windows xp, IE7(dwnloaded 7 to see if that would help) I checked and lowered my sec. setting on comp. and use McAFee for security ...any sugestions? Tag: Event ID 675 Tag: 99206
  - 4
    - Don't have create access in Windows 2003 server I've run into this problem on several (but not all) windows 2003 server: When I try to create a home folder for a new user, I'm told that I (as domain administrator) don't have create access to the server, and that the folder will not be created. If I manually create it, I've had issues where the user will only have read access to their files, even when they are the owner and permissions are reset. None of this occurs with any consistency. I can't find anything at Microsoft about this. Please help. -- %20--The Final Frontier Tag: Event ID 675 Tag: 99195
  - 5
    - Is DNSSEC supported by Windows? Is the Windows XP DNS resolver able to check the validity of the DNS data using DNSSEC? Is this feature turned on by default? And does the Windows Server support DNSSEC for publishing the public DNS records? Tag: Event ID 675 Tag: 99193
  - 6
    - email notification patches and security updates Hello All, Are there subscriptions from Microsoft for security related patches and updates which will notify you automatically through email? I know this may seem like a silly question. Thanks, Altria Tag: Event ID 675 Tag: 99191
  - 7
    - Security discussion regarding hubs, firewalls, anti-virus and Vista Security discussion These are a very basic set of questions. Possibly there is an article on the web that someone can point me to that fully addresses each of these: What security protection should I expect from: a wireless hub/router a software firewall a software anti-virus, anti-trojan program the security built into Vista The reason I ask this is that I have a Linksys wireless hub with a WEP code activated and I also had Zonealarm with Windows XP. I had my files shared. I thought that the wireless hub should provide hardware based security from anyone being able to "look" at my files and anything behind the hub. I found that Zonealarm was giving me a lot of warnings of malware and other outside people finding me and trying to access my computer and that Zonealarm was stopping this. I don't understand the Linksys hub's capabilities well enough to not ask "why was the hub not keeping these outside intruders out?". I now have Vista and the security it provides is suffocating. I have a hard time accessing my own files on other computers on my network and you need an ADVANCED IT degree to work around it. I would think that you could provide a secure "knock'em dead" firewall with a Linksys hub that would allow you to be "naked" behind the firewall so you did not have to deal with security at all once you were safe behind the Linksys firewall. I think this shows why I need to learn all I can so I don't leave my UAC off (which it is right now). microsoft.public.security Tag: Event ID 675 Tag: 99186
  - 8
    - Update on website attacks in Georgia and Russia It's very easy to think that this conflict is happening a long way away from our own countries, and doesn't affect us. But that's wrong. The denial-of-service attacks that are striking websites in the region are being relayed through innocent people's computers all around the world. Your Aunty Hilda's computer, which may normally be pumping out Viagra adverts, could today be engaged in a DDoS attack. In other words, you may unwittingly be taking part in a cyber war. So, make sure your computers are properly defended with anti-virus software, security patches and firewalls. And lets all hope that the current military conflict comes to a speedy and peaceful resolution. Posted on August 12th, 2008 by Graham Cluley, Sophos http://www.sophos.com/blogs/gc/g/2008/08/12/update-on-website-attacks-in-georgia-and-russia/ Tag: Event ID 675 Tag: 99183
  - 9
    - Web attacks explained: SQL injection - the biggest threat on the web Sophos experts have produced a free podcast offering administrators and web surfers advice on how to safeguard themselves against becoming a victim from SQL injection, where malicious and automated code attacks poorly configured database-driven websites. Learn more from the experts and listen to this free podcast to understand the threat better. http://www.sophos.com/news/2008/08/sql-podcast.html Tag: Event ID 675 Tag: 99182
  - 10
    - EZI_HTTP_NETDEV_DISCOVER Hi I have spent quite a bit of effort trying to get a handle on IIS log entries that contained this user agent signature EZI_HTTP_NETDEV_DISCOVER. They failed, since the server does not allow anon access, and generated security log entries of event = 529, with null user, and roving IP dresses. It looks like a nasty, but it's not, I'm posting here so as to save future searchers the hassle, hopefully google will pick it up soon. David L. www.rabboar.com www.rbqaeng.com From a post on the LinuxQuestions.org it turns out that it's: Hi, my name is Scot Zarkiewicz and I am the CEO of SingleClick Systems. We are the manufacturer of the tool that is in question in this thread. I wanted to quickly describe to people what they are seeing. Dell Network Assistant (AKA: HomeNet Manager, Network Now, Network Now Pro!) is a Home Networking tool that provides, as one of its capabilities, a Network Scan feature, to detect all the devices that are connected to the Home Network. When we find a device we do probe port 80 to see if that device is exposing a management interface. This actually provides for a very useful function to less technically savy customers who may not know how to open a management interface to a device such as a print server. Additionally we do probe the router to determine what type of device the user has, and provide one click access to this device as well. The URL that is mentioned above is used for Internet Health monitoring to determine when the user has lost their connection to the Internet (and take corrective action to resolve that problem.) I wanted to reassure the readers of this message board that the network traffic generated by our applications is not meant to be harmful in anyway, and is only taking place to give the more novice user a simpler way to setup and manage their Home Network. If there are additional questions or concerns about this topic please don't hesitate to contact me directly at: scotz@singleclicksystems.com Tag: Event ID 675 Tag: 99177
  - 11
    - Windows 2003 Server R2 Std Edition - Get erro 619 when trying to V I have a Windows 2003 Server R2 Std Edition (fully patched). I created a VPN connection to a remote VPN server using L2TP and IPsec and it was working, however now, I always get error 619 when trying to connect. I've created this VPN connection on an XP Pro SP2 machine on the same LAN and it connects successfully. Where is Windows 2003 Server R2 preventing this and how can it be adjusted? Thanks, Hemmy Tag: Event ID 675 Tag: 99159
  - 12
    - uebergroessen versand jeans in uebergroessen stiefel uebergroessen damenmode uebergroessen uebergroessen in berlin uebergroessen versand jeans in uebergroessen stiefel uebergroessen damenmode uebergroessen uebergroessen in berlin +++ UEBERGROESSEN KAUFEN +++ UEBERGROESSEN ONLINE BESTELLEN ++ http://WWW.UEBERGROESSEN-KAUFEN-24.INF http://WWW.UEBERGROESSEN-KAUFEN-24.INF http://WWW.UEBERGROESSEN-KAUFEN-24.INF http://WWW.UEBERGROESSEN-KAUFEN-24.INF http://WWW.UEBERGROESSEN-KAUFEN-24.INF http://WWW.UEBERGROESSEN-KAUFEN-24.INF +++ MAENNERKLEIDUNG KAUFEN +++ MAENNERKLEIDUNG ONLINE BESTELLEN ++ http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF http://WWW.MAENNERKLEIDUNG-KAUFEN-24.INF +++ DAMENKLEIDUNG KAUFEN +++ DAMENKLEIDUNG ONLINE BESTELLEN ++ http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://WWW.DAMENKLEIDUNG-KAUFEN-24.INF http://ibm-news.for-um.de/showthread.php?t=1493 http://www.gamesforum.ca/showthread.php?t=31174 http://viagra.learnerblogs.org uebergroessen mannheim bademoden uebergroessen uebergroessen koeln schuhe uebergroessen hamburg herrenmode in uebergroessen anzuege uebergroessen ballerinas in uebergroessen herrenschuhe uebergroessen damenmode uebergroessen mode uebergroessen herrenschuhe in uebergroessen uebergroessen kinder uebergroessen models bademoden uebergroessen high heels uebergroessen unterwaesche uebergroessen kleider in uebergroessen kindermode uebergroessen uebergroessen duesseldorf betten uebergroessen sicherheitsschuhe uebergroessen uebergroessen onlineshop uebergroessen models weingarten uebergroessen bekleidung in uebergroessen uebergroessen models uebergroessen hannover uebergroessen online uebergroessen kinder ballerinas uebergroessen abendkleider uebergroessen t shirts in uebergroessen uebergroessen nuernberg umstandsmode uebergroessen uebergroessen koeln maennermode uebergroessen Tag: Event ID 675 Tag: 99111
  - 13
    - Preferred RootKit detection/removal tool? Gurus, I know Symantec offers RootKit detection tools, as does Panda Security, F-Secure, to name a few. However, this is addressed to those of you in this newsgroup, which of those do you prefer to use "out in the field"? -- Spin Tag: Event ID 675 Tag: 99110
  - 14
    - Giving admins Local Admin to DC's not Domain Admins Hi guys I have a requirement to be able to let certain sets of administrators the ability to login to domain controllers with out permissions over the whole domain. Althought I can give the users PowerUser or LocalLogon rights via making a domain security group a member of the PowerUser or LocalLogon group there does not appear to be a local admin group on DCs. Can you with Server 2003 give a user just local admin to a DC without DA rights??? Tag: Event ID 675 Tag: 99095
  - 15
    - PdhConnectMachine from a Service Hi, This has been posted before, but I could not find a proper resolution or explnantion for what I am seeing. I have an app that performs a PdhConnectMachine in order to monitor a remote machines performance counters. This app runs as scheduled task under the SYSTEM account. Prior to calling PdhConnectMachine, it calls WNetAddConnection2 in order to create a connection, which I think PdhConnectMachine uses to connect. WNetAddConnection2 has a user and password supplied to it externally. This works fine on a number of machines here at the office, but does not work on a remote site. PdhConnectMachine fails with PDH_CSTATUS_NO_MACHINE. However, WNetAddConnection2 always succeeds. Also, if the same app is run directly by a user (i.e. a login other than SYSTEM), the app succeeds. The fact that it works in some cases seems to imply that this is not some inherent issue with using the SYSTEM account to perform these actions. Are there some network security settings IT administrators can apply that would cause this? Or perhaps there are some other security settings which could cause this to fail for some machines, but not for others? Thanks! Tag: Event ID 675 Tag: 99094
  - 16
    - Service accounts with password expiration The corporate auditing requires that all accounts' passwords expire, including service accounts. Questions: 1. Is it really a security recommendation? 2. Is there an easy way to automate this process (as a scheduled task, for example)? 2. If a modify the password in the service settings, will this one keep running with no disruption? 3. If I modify passwords for clustering service accounts, will those ones keep running with no disruption? Thanks, Felipe Tag: Event ID 675 Tag: 99093
  - 17
    - IT auditing tool SC Magazine Review Secure Bytes audit and vulnerability assessment software Secure Auditor named =93Versatile tool=94 and earn =93Five Star Ratings=94 in SC Magazine Group Test Secure Bytes is really pleased to share this great news with its associates that Secure Auditor has been branded as a Five Star product by SC Magazine August 2008 edition. SC Magazine is among the world=92s most prestigious Information Security magazines. In the comparative review with current available products in today=92s market, Reviewers concluded the Secure Auditor evaluation with Verdict as a =93Versatile tool.=94 It is summed up as a tool that =93offers a great amount of flexibility and auditing capabilities for a broad range of different assets. We find this offering to be a good value for the money.=94 Reviewers commend Secure Auditor as intuitive to use and install. It is considered to offer great amount of flexibility and auditing capabilities for a broad range of different assets and a good value for the money. Secure Auditor earns highest star rating possible in overall rating category of a Comparative Review. It receives 5 out of 5 stars in Features, Performance, and Documentation categories which are being evaluated. Secure Auditor receives reviewers praising immediately in the product=92s published review as =93A suite comprised of several different pieces designed to audit vulnerabilities across a broad range of systems. Because of this thorough analysis of a range of systems, administrators can be sure that all the various components across the networks are secure and up to date.=94 The review continues, highlighting other areas in which the Secure Auditor excels. Flexibility & Performance: =93This product can scan many different platforms, and we found this flexibility to add greatly to the performance value of the product=94 Intuitive to Use: =93We found this product to be quite intuitive to install and use. Installation takes just a few minutes and is guided by an easy-to-follow setup wizard.=94 Management & User Interface: =93Management is done through a well organized user interface, which is also quite intuitive to navigate.=94 Secure Bytes appreciate SC Magazine's product review team for considering Secure Auditor in their recent group test for vulnerability assessment. It is a great recognition from a trusted industry leader like SC Magazine just within few months of Secure Auditor=92s launch. It validates Secure Auditor performance and features. You can find more information and detailed review about Secure Auditor from following link. http://www.scmagazineus.com/Secure-Auditor-20/Review/2526/ Tag: Event ID 675 Tag: 99089
  - 18
    - Get information about signature from signed file Hello! I'm trying to get info from signed file in Visual Basic 2005. Although it's possible to get basic infos (eg. Version) I haven't found how to programically retrieve informations about signer and date of signing. Can you help me with that? (for signing I'm using CAPICOM) Thanks & Regards Tag: Event ID 675 Tag: 99077
  - 19
    - Configuring a security policy to connect two servers via a LAN I have a Web Server and an SQL server both running under Windows 2003. I want to connect to the SQL Server database from the websites on the Web Server. There is a private LAN between the two servers. They are not on the same work group but I can access shared folders across the LAN using the syntax '\\<ipaddress>\<SharedFolder>' in the Explore address. (The servers are hired from a remote Host supplier and this is the way that I have to communicate between servers). To test this, I have set up on both servers a shared folder with Everyone permissions set to 'Allow full control'. Both the servers have the Windows Firewall active. The Web Server has a Security Policy set up using the Security Configuration Wizard. The SQL Server does not. From the SQL Server, I can access the shared folder on the Web Server using \\<ipaddress>\<SharedFolder> in Explore after entering the username and password of the latter when prompted. From the Web Server, I CANNOT access the shared folder on the SQL Server by the same method, getting the error 'Windows cannot find '\\<ipAddress>\<SharedFolder>'. Any ideas why? Is it to do with the Security Policy setup on the Web Server? If so, how do I update it to fix the problem? I've looked through the Security Configuration Wizard but can't see anything obvious. Turning both firewalls off does not fix the problem. Any help much appreciated. Thanking you in anticipation. Roger Tag: Event ID 675 Tag: 99072
  - 20
    - Possible Unknown intruder.. Hi, My machine have XP pro SP3 and also have NOD32 antivirus Business Edition install both uptodate. I have firewall on. I don't have any network sharing folder open or any other program open, but when I reboot my pc, a notice dialog pops up saying something like this "another user is still connected to your computer. are you sure you want to turn off your computer?". My question, is there a way to tell whos connected? Thanks in advance! Mingo Tag: Event ID 675 Tag: 99063
  - 21
    - svchost.exe hey there, I know there is few fourms out the on this files. But It wasnt quite helpful. My problem is this svchost.exe file Now shows up in my taskmanaher like 5 to 6 places. 2 files for - NETWORK SAERVICES 1 file for - LOCAL SERVICE 3 files for - SYSTEM What I mean is svchost.exe shows up in my TASKMANAGER 6 times. So its running in background or sumthing. How I do find out which is legit and which one is not. So we can get rid of it. Any input is appriciated. Thanks. Tag: Event ID 675 Tag: 99050
  - 22
    - USB device Hello, How to disable USB device except keyboard and mouse? Thanks Tag: Event ID 675 Tag: 99049
  - 23
    - Critical Updates I downloaded 9 Critical Updates for my WinXPsp3 desktop and saw one titled: KB 953838" which was Cumulative Security Update for Internet Explorer 6 for Windows XP." When I downloaded Critical Updates for my Vista sp1, I also noticed a "KB 953838" Cum Update for IE7. Is that possible? An update for IE6 and an update for IE7 with the same KB 953838? Tag: Event ID 675 Tag: 99042
  - 24
    - Free Anti-Virus & Other Safety Software Every computer connected to the internet is vulnerable to fraud and computer vandalism. This leaves our pockets prey to the software protection industry's heavy charges to keep us safe. Yet it's possible to get legal, professional quality anti-virus and other protective software, absolutely free. Every computer connected to the internet is vulnerable to fraud and computer vandalism. This leaves our pockets prey to the software protection industry's heavy charges to keep us safe. Yet it's possible to get legal, professional quality anti-virus and other protective software, absolutely free. Please read here:- http://www.moneysavingexpert.com/shopping/free-anti-virus-software Tag: Event ID 675 Tag: 99040
  - 25
    - CA in AD I have a certificate authority already registered in AD, unfortunately it has 2 problems. 1. it has a mis-leading name 2. I can't load certificate templates my questions are 1. can I rename it (I guess not) 2. why won't it let me load templates 3. should I give up on it, build a new root and subordinate CA tree, move the services to the new tree and then remove the old one ? 4. as I have a multi-tree AD forest should the root-CA go in the root domain ? many thanks James Tag: Event ID 675 Tag: 99032
- Next
  - 1
    - Kaspersky - sudden interruption I was running Kas as usual when it suddenly said Firefox couldn't establish connection with a certain IP address.. then it went gray and said "Protection of your computer is disabled." I was able to restart Kaspersky as usual. This is the only time it's happened since I got Kas a few months ago. Do you know why it would say that?? Tag: Event ID 675 Tag: 99026
  - 2
    - AD for testing Hi, I have to test one security application and I need to install a AD in my notebook to performance this task, someone in the past talk me about some AD "lite" normally use for development. Suggesting are appreciate, and thanks in advance. TekNET Tag: Event ID 675 Tag: 99024
  - 3
    - Security Baselines Need help with security baselines. So far I have started on a member server and included security templates and security configuration and analysis. Now what is needed to analysis this server and what of the results? Please help. Tag: Event ID 675 Tag: 99023
  - 4
    - August 12 is a Critical Patch Day Just an FYI for all Windows 2000 and later users out there that this is indeed a major patch day on Tuesday. Please see if interested: http://www.microsoft.com/technet/security/bulletin/ms08-aug.mspx Tag: Event ID 675 Tag: 99013
  - 5
    - login domain Hello, 1. Where can I enable the log files to record the users copy, delete, move... files or folders? 2. If the user unplug the networking cable, can he login local computer with domain user right? Thanks Tag: Event ID 675 Tag: 99009
  - 6
    - CertEnroll+ USBcryptoTokens - Getting an error while generating Hi all, I have to generate certificate request using CertEnroll on my Vista. It must be generated on the web page. To do this I use Javascript. I crteate X509EnrollmentWebClassFactory object (the basic one) and other objects with web enabled tag. My code works fine when I want to generate the request using for example 'Microsoft Strong Cryptographic Provider'. The problem appears when I use my token CSP - 'Charismathics Smart Security Interface CSP' (drivers You can download form www.charismathics.com). In this situation function CreateRequest() start working and throw na error: --------------------------- Windows Internet Explorer --------------------------- Error: CertEnroll::CX509Enrollment:Stick out tongue_CreateRequest: ASN1 - unexpected end of data. 0x80093102 (ASN: 258) --------------------------- OK --------------------------- Token works OK with Windows XP and mozilla and its behavior look fine on vista (before an error apprears the private and public keys are stored in token's memory). Does anybody have similar problem with tokens? Could you help me with this one?? Maybe I'm not set all privateKey Attributs or something like this? Any suggestions? This is my code my shows the problem: <html> <head> <SCRIPT LANGUAGE="JavaScript">  </SCRIPT> </head> <body onLoad='genReq()'> <H1>generate cert req.</H1> </body> </html> thanks in advance, miiiiichal Tag: Event ID 675 Tag: 99004
  - 7
    - Accoutn being locked out repeatedly We havea corporate domain, and are experiencing an issue with one of the administrator accounts. It constantly locks/disables itself, and it takes less than 10-20 seconds from the time I go in (another admin) and unlock it. At first we thought it was a problem with his phone synching with Exchange, but we have eliminated that variable and it still occurs. Furthermore, when checking the security section of the event viewer on the domain controller, there4 are no associated login failures which would cause an account to be locked out. I have enabled the account, refreshed the event viewer, ... no failed attempts, then looked at the account again and it is locked out. All of this happens in 10 seconds or so. I am not sure what else I can check as the only policy we have in place to disable an account takes place when there are 3 failed logins. Any other suggestions I can look at or investigate? The DC is Server 2003 and the system the other admin uses is an XP machine (but I do not beleive that is relevant). I would love to hear from any of you, thanks in advance. Tag: Event ID 675 Tag: 99001
  - 8
    - SP3 Registry change warnings I downloaded SP3 from another computer and installed it from a CD. I have Spybot, which raised about 25 registry key warnings as I installed, which I allowed. and now as I am rebooting, I am getting another 25 or so registry key warnings. They are things such as: System Startup Global Entry Value Deleted Entry: OE_WMPWMFSDK_INSTALL_24 Old data: C\WINDOWS\SYSTEM32\regscr32 /s "C:\WINDOWS\SYSTEM32\WMSdmod.dll" and Old Data: C:\WINDOWS\INF\unregmp2.exe/ Migrate Library My instinct is to deny these changes that are made after reboot. Can anyone offer suggestions? Thanks so much to those who offer time and talent here. Tag: Event ID 675 Tag: 98999
  - 9
    - Windows Defender detection of Vundo trojan Apologies if this is the wrong board for this - if so, happy to re-post in a more appropriate place, just tell me where ! Windows Defender keeps reporting an infection with Vundo.gen!E. The advice on the MS site says remove it using an AV program. I use McAfee, but when I run a scan it can't find it - checking the update status of McAfee, I have the right updates that should detect this version of Vundo. So I can't actually follow the "how to remove" advice. So is Defender giving a false positive, or should I be really worried because I seem to have an infection that McAfee can't find ? Any advice on how to proceed gratefully received. Not sure whether this is relevant or not, but since getting the first Vundo detections, in the same account that apparently hosts Vundo, the user gets a message on logon to the effect that the system can't find a file opnkjghf.dll. Could this be related to the Vundo problem ? System: XPSP2 IE7 Windows Live Mail Windows auto-update checked ON AV & Firewall: McAfee, latest engines & updates installed. Thanks in advance Tag: Event ID 675 Tag: 98990
  - 10
    - how to secedit export everything How can I export everything out from the local security policies as a backup? I had tried to use secedit /export /cfg c:\temp\local.inf /areas However it keep prompting parameter is incorrect. I tried to use secedit /export /cfg c:\temp\local.inf However settings such as services, regkeys are not being saved out. Thanks Tag: Event ID 675 Tag: 98987
  - 11
    - TROJAN INFO Hey, I was just running a AV scan thru my ESET's NOD32. I just got a new update from online with more signatures and stuff. So I wanted to do the scan see if something pops up. I do this scans about every 2 or 3 days. I did have Vundo trojan before like a 3 to 4 weeks ago. Thanks to Microsoft MVPS, Fourms like this & Aumha Fourms that problem was taken care of. Here is the Error popped just few min. ago. Threat :- Win32/Agent.OBH Trojan. Anyone know what that means or what type of trojan are we talking about here. Thanks for your input. Tag: Event ID 675 Tag: 98985
  - 12
    - Blocked newspaper reader comments My local newspaper allows readers to comment to news articles. I must have set some security setting in ie that blocks my ability to read those comments. If I log on to the same computer as a different user, I have no problem. Does anyone have any ideas how I can fix this? Tag: Event ID 675 Tag: 98981
  - 13
    - Security and Sharing I have a folder that I've created a share on. How come there are more security permissions than share permissions? I don't understand this stuff. I want a group to be able to write files to the directory but if I give them Write rights in Security it doesn't work. When I go to share permissions, there are very limited rights available, Full Control, Read, and Change. Where are the write rights?? Tag: Event ID 675 Tag: 98972
  - 14
    - Scanning of encrypted content Looking for active antivirus program that supports the scanning of encrypted content as supported by the Microsoft Antivirus API. I have an Excel Wookbook that is password protected. When I Save changes to this workbook I get the following Information Message: This document is both encrypted and password protected. The Office Open XML Formats available in the 2007 release provide stronger encryption. Do you want to increase the security of this document by converting to an Office Open XML Format? I said YES once but there's a problem as noted below: I've researched and found out the following information. Problem: A macro contained in an encrypted Office Open XML file does not run in 2007 Office programs. CAUSE This behavior occurs if the computer is not running an active antivirus program that supports the scanning of encrypted content as supported by the Microsoft Antivirus API. In this case, macros are disabled in encrypted Office Open XML files. RESOLUTION To resolve this behavior, upgrade the antivirus program to a program that supports the scanning of encrypted content as supported by the Microsoft Antivirus API. I have both McAfee Security Center & Norton Anti Virus 2007. They do not provide support for this... Tag: Event ID 675 Tag: 98970
  - 15
    - Zone Alarm Via Command Prompt ? I know there is a way to control the Windows XP firewall via the command prompt. Is there some documentation on how to do the same with Zone Alarm ? Thanks Tag: Event ID 675 Tag: 98968
  - 16
    - Connection issues between windows server and samba! We have a Windows Server 2003 cluster which accesses data held on a samba share hosted on a Solaris 9.0 machine in a trusted domain. However we regularly lose connectivity to the samba share from one of the application servers. The share is up but the server is unable to access it. If I RDP on to the server and try and browse the share I receive the following error. \\serveralias\share is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. No network provider accepted the given network path. If I use a FQDN (unix machine is in a different domain) or IP address to access the share it works correctly. If i reboot the server access to the share is restored. This one has me beat - any advice would be appreciated - kerberos issue?? Thanks in advance Tag: Event ID 675 Tag: 98951
  - 17
    - Hacking into Hotmail Acct. I believe that my soon to be Ex has hacked into my email hotmail account a couple of times. I have since changed my pass and secret question to something he would never get but....my question is, I know that this is a felony in my state but I need evidence other than him saying he has my emails. Is there a way to get the IP addresses that have accessed my account? This would show his address at home or work, right? How do I obtain that information? Also, I received an "annonymous" email last night - are these truly untracable? It contained my emails that I know he has hacked into. But is there a way to find out who really sent it? Tag: Event ID 675 Tag: 98944
  - 18
    - Virus and/or hacking problem with Windows Messenger I'm running Windows XP Pro SP2 and Windows Messenger v5.1.0701 About 10 days ago, I received 2 IM's, several hours apart, from one of my contacts. Both of them asked me to go to unknown websites, a different site in each message. I was very suspicious and cautious, because I had never received this kind of IM before. The website from the first message asked me to login with my MSN account and password. I refused to do so. I never visited the website from the second message. I sent an email to my contact and asked him if he had originated these 2 IM's. His answer was that he had not, and that many of his other contacts had reported the same thing happening to them. He suspects either he has a virus which is exploiting his Messenger account, or someone has hacked into his account and is using it. I shut down Messenger on my end and left it off until today. When I re-started Messenger I had a notice that someone I have never heard of has added me as a contact. I blocked that person from contacting me. His ID is Brooke, his email and Sign-in name are brookesised@hotmail.com, and his service is .NET Messenger Service. I see how to remove him from *my* contact list. Is there any way for me to remove myself from *his* contact list? Is this something new, or is this a known and documented exploit? Is there a fix for my contact, who apparently is the victim? Thanks! John -- Please reply in this newsgroup. I never post my true email address to prevent spam. Thank you. Tag: Event ID 675 Tag: 98941
  - 19
    - User permissions for remote event watcher Hi all, I posted this in the WMI newsgroup, but there's not much action there! Perhaps I can find some help here... I have a simple little Windows service that retrieves events from a remote computer through WMI and a ManagementEventWatcher. It all works just fine... as long as the user I specify in my ConnectionOptions (see below) is an administrator of the remote computer. My problem is that (for security reasons) I cannot use an administrator account. I have created a clean account, currently with no permissions on the remote computer. Now I want to add just the permissions needed for my service to work, but I can't find anywhere what permissions that is! Please enlighten me! / Mikael This is the essentials of the service: ConnectionOptions connection = new ConnectionOptions(); connection.Impersonation = ImpersonationLevel.Impersonate; connection.Username = "NotAnAdminUser"; connection.Password = "LetMeIn"; ManagementScope scope = new ManagementScope(@"\\remotecomputer\root \cimv2", connection); scope.Connect(); string query = "SELECT TargetInstance FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent'"; ManagementEventWatcher watcher = new ManagementEventWatcher(scope, new EventQuery(query)); watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); watcher.Start(); (currently I get to scope.Connect() where I run into an UnauthorizedAccessException) Tag: Event ID 675 Tag: 98940
  - 20
    - object access failure audits Although only an annoyance, when users print on my network I get an error event ID 560 in the Security log. I audit for print success/Failure and failure to delete print jobs using the 'everyone' group. Can someone shed some light on this and what I can do to get rid of these events. The users all are allowed to print to these printers, and I get the usual print event in the system log. Tag: Event ID 675 Tag: 98935
  - 21
    - Is this the right group for C&A remediation questions? Gurus, Is this the right group for C&A remediation questions? OR is there an NG dedicated to questions on the C&A process (which covers a range of OSes beyond just Microsoft). -- Spin Tag: Event ID 675 Tag: 98932
  - 22
    - Wanted: More Advanced Administration Tool(s) Hello, Can anyone please recommend any software tool(s) that could help an administrator (Windows 2003, Windows XP, and eventually Windows Vista) to quickly find answers on questions like these: (1) For a given computer, show all the resources (files, folders, registry entries, etc.) that have any permissions/restrictions specified for a given account (local or domain-level account, user or group)? (2) For a given resource and account, show all the effective permissions AND WHY EXACTLY EACH OF THESE PERMISSIONS IS WHAT IT IS? Ideally, the tool should be aware of implied permissions too (like a resource owner's implicit permission to change permissions for the resource). BTW, it would also be nice if the tool provided some additional help in managing group memberships. For example, it would be nice if it allowed to document memberships (i.e. for each group member, document why exactly does this member has to be in this group). Thank you, Yarik. Tag: Event ID 675 Tag: 98927
  - 23
    - wireless driver security: don't work as non-admin Hi I have a small security problem. I got it on win2ksp4 with netgear wg111t and now encounters the same problem on winxpsp3 with an asus notebook (intel pro/wireless 3945abg chipset). The box is installed correctly, wifi drivers too and they work as an admin user. But when using a non-admin account, it seems the driver can't load or initialize network, so i'm without network when using non-privileged account and forced to make some users to use admin whereas they don't need it. I think it's a dev problem from the constructor but want to check that's not microsoft's and this problem is solved in Vista. Is it the case ? thanks Tag: Event ID 675 Tag: 98922
  - 24
    - Evebntcombmt Tool Hi We're looking to give our service desk acess to the Eventcomb tool to be able to determine where an account is being locked out but currently when they execute to look for locked accounts it comes up with an GetLastError was 5 Error text was Access Denied, the assumption here is there accounts do not have enough permissions to be able to run the tool. What modifications might be made to enable them to have the ability to run the tool. Thanks -- John Tag: Event ID 675 Tag: 98921
  - 25
    - Can somebody please explain rights in security and sharing? I have a 2003 Server. I have a D: drive. I can right click this drive and click security and set file permissions here. Full Control, Modify, Read Execute, List, Read, and Write. I have also created a share on this D: drive. The share is for the whole d: drive. In the share's permissions, there is only Full Control, Change, and Read. I have remote user who needed to create directorys and what not, so I gave him full control in the security permissions for the D: drive. He said it didn't work and he wasn't able to do anything. I then went to the share's permissions and gave him full control and he's fine now. I am so confused now about the two sets of permission levels. Can somebody please explain how this all works? Tag: Event ID 675 Tag: 98912

For workstations Event ID 529 indicated a failed attempt to login to or
through a workstation. Does Event ID indicate the same but when attempting
to login to a Windows 2003 Server?

Top

Re: Event ID 675 by S

S
Tue Aug 26 03:41:51 CDT 2008

G'day:

Johnny Mac wrote:
> For workstations Event ID 529 indicated a failed attempt to login to or
> through a workstation. Does Event ID indicate the same but when attempting
> to login to a Windows 2003 Server?

Yep.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

Top

Re: Event ID 675 by kalyan

kalyan
Wed Sep 17 02:15:18 CDT 2008

hi

check out

http://support.microsoft.com/kb/890477

--
Warm Regards
Kalyan

"Johnny Mac" <JohnnyMac@discussions.microsoft.com> wrote in message
news:DA40CB6E-E854-44F2-B3D1-F9F790F37156@microsoft.com...
> For workstations Event ID 529 indicated a failed attempt to login to or
> through a workstation. Does Event ID indicate the same but when
> attempting
> to login to a Windows 2003 Server?

Top