Event Viewer Security shows Guest logon?

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 5/11/2006
Time: 1:19:23 PM
User: MOMS\Guest
Computer: MOMS
Description:
User Logoff:
User Name: Guest
Domain: MOMS
Logon ID: (0x0,0x3FFDBD)
Logon Type: 3


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Having multiple entries as shown above. Is someone logging on my system as
guest? Running XP Home, DSL with wireless router. Thanks in advance,
Patrick.

Steven
Thu May 11 20:46:57 CDT 2006

It seems that someone accessed your computer via the network as logon type 3
is network logon. XP Home can only use simple file sharing where anyone
accessing the computer from the network accesses it as guest. If you have no
other computer on your network this would be cause for concern and I would
disable file and print sharing on that computer, enable the Windows
Firewall, and verify that your firewall protection is adequate. You can go
to one of the self scan sites such as http://scan.sygatetech.com/ to see
what holes they find in your firewall if any.

If you are using WEP for your wireless security you can also be vulnerable
because WEP is not secure by today's standards though it is better than no
wireless encryption which leaves your network wide open. If you have not
other choice change your WEP key frequently like at least once a week. WPA
is much better if your wireless router and adapter support it. Even with WPA
be sure to use a complex key of at least 12 characters. If someone accesses
your wireless network your computer is not protected by the wireless
router's firewall function that only protects it from untrusted networks
such as the internet. The Windows Firewall however could protect it from
such.

Of course make sure you check the computer for malware and spyware as it is
possible that a backdoor application is installed on the computer. Be sure
to use the latest definitions for whatever program you scan with by
downloading them from the vendors website. --- Steve

http://www.microsoft.com/athome/security/protect/windowsxpsp2/Default.mspx
-- Protect Your PC tips

"Patrick Casher" <me@privacy.net> wrote in message
news:U0R8g.4107$fb2.577@newssvr27.news.prodigy.net...
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 538
> Date: 5/11/2006
> Time: 1:19:23 PM
> User: MOMS\Guest
> Computer: MOMS
> Description:
> User Logoff:
> User Name: Guest
> Domain: MOMS
> Logon ID: (0x0,0x3FFDBD)
> Logon Type: 3
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Having multiple entries as shown above. Is someone logging on my system
> as guest? Running XP Home, DSL with wireless router. Thanks in advance,
> Patrick.
>

Roger
Fri May 12 03:43:19 CDT 2006


"Patrick Casher" <me@privacy.net> wrote in message
news:U0R8g.4107$fb2.577@newssvr27.news.prodigy.net...
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 538
> Date: 5/11/2006
> Time: 1:19:23 PM
> User: MOMS\Guest
> Computer: MOMS
> Description:
> User Logoff:
> User Name: Guest
> Domain: MOMS
> Logon ID: (0x0,0x3FFDBD)
> Logon Type: 3
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Having multiple entries as shown above. Is someone logging on my system
> as guest? Running XP Home, DSL with wireless router. Thanks in advance,
> Patrick.
Just to emphasize two things already mentioned by Steve . . .
To answer your question: yes.
Turn on your firewall, and if you have allowed any exceptions
use the scope capability on the exceptions to make sure only
the intended machines (i.e. IPs) are allowed.

Patrick
Fri May 12 08:03:03 CDT 2006


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:Ow3ahAadGHA.1324@TK2MSFTNGP04.phx.gbl...
>
> "Patrick Casher" <me@privacy.net> wrote in message
> news:U0R8g.4107$fb2.577@newssvr27.news.prodigy.net...
>> Event Type: Success Audit
>> Event Source: Security
>> Event Category: Logon/Logoff
>> Event ID: 538
>> Date: 5/11/2006
>> Time: 1:19:23 PM
>> User: MOMS\Guest
>> Computer: MOMS
>> Description:
>> User Logoff:
>> User Name: Guest
>> Domain: MOMS
>> Logon ID: (0x0,0x3FFDBD)
>> Logon Type: 3
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Having multiple entries as shown above. Is someone logging on my system
>> as guest? Running XP Home, DSL with wireless router. Thanks in advance,
>> Patrick.
> Just to emphasize two things already mentioned by Steve . . .
> To answer your question: yes.
> Turn on your firewall, and if you have allowed any exceptions
> use the scope capability on the exceptions to make sure only
> the intended machines (i.e. IPs) are allowed.
>
>
I'm using Zone Alarm firewall. I also share my printer and share folder
with my laptop. Does the laptop automatically log on as guest?

Roger
Fri May 12 08:33:27 CDT 2006


"Patrick Casher" <me@privacy.net> wrote in message
news:bI%8g.25308$4L1.19492@newssvr11.news.prodigy.com...
>
> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
> news:Ow3ahAadGHA.1324@TK2MSFTNGP04.phx.gbl...
>>
>> "Patrick Casher" <me@privacy.net> wrote in message
>> news:U0R8g.4107$fb2.577@newssvr27.news.prodigy.net...
>>> Event Type: Success Audit
>>> Event Source: Security
>>> Event Category: Logon/Logoff
>>> Event ID: 538
>>> Date: 5/11/2006
>>> Time: 1:19:23 PM
>>> User: MOMS\Guest
>>> Computer: MOMS
>>> Description:
>>> User Logoff:
>>> User Name: Guest
>>> Domain: MOMS
>>> Logon ID: (0x0,0x3FFDBD)
>>> Logon Type: 3
>>>
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Having multiple entries as shown above. Is someone logging on my system
>>> as guest? Running XP Home, DSL with wireless router. Thanks in
>>> advance, Patrick.
>> Just to emphasize two things already mentioned by Steve . . .
>> To answer your question: yes.
>> Turn on your firewall, and if you have allowed any exceptions
>> use the scope capability on the exceptions to make sure only
>> the intended machines (i.e. IPs) are allowed.
>>
>>
> I'm using Zone Alarm firewall. I also share my printer and share folder
> with my laptop. Does the laptop automatically log on as guest?
>

"automatically" ??
depends on how you have things set up.

Do you see the event msgs when the laptop is connected and booted,
and not see them when it is not ??

Malke
Fri May 12 08:40:12 CDT 2006

Roger Abell [MVP] wrote:

>> I'm using Zone Alarm firewall. I also share my printer and share
>> folder
>> with my laptop. Does the laptop automatically log on as guest?
>>
>
> "automatically" ??
> depends on how you have things set up.
>
> Do you see the event msgs when the laptop is connected and booted,
> and not see them when it is not ??

Does the laptop run XP Home as well as the Desktop? Home always
authenticates on the remote system as Guest. If the laptop runs Home,
you can create an identical user account and password on it to match
the one(s) on your desktop. Set Zone Alarm to allow traffic from the
local lan.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Patrick
Fri May 12 12:58:13 CDT 2006


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:uv1hpicdGHA.1456@TK2MSFTNGP04.phx.gbl...
>
> "Patrick Casher" <me@privacy.net> wrote in message
> news:bI%8g.25308$4L1.19492@newssvr11.news.prodigy.com...
>>
>> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
>> news:Ow3ahAadGHA.1324@TK2MSFTNGP04.phx.gbl...
>>>
>>> "Patrick Casher" <me@privacy.net> wrote in message
>>> news:U0R8g.4107$fb2.577@newssvr27.news.prodigy.net...
>>>> Event Type: Success Audit
>>>> Event Source: Security
>>>> Event Category: Logon/Logoff
>>>> Event ID: 538
>>>> Date: 5/11/2006
>>>> Time: 1:19:23 PM
>>>> User: MOMS\Guest
>>>> Computer: MOMS
>>>> Description:
>>>> User Logoff:
>>>> User Name: Guest
>>>> Domain: MOMS
>>>> Logon ID: (0x0,0x3FFDBD)
>>>> Logon Type: 3
>>>>
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>> Having multiple entries as shown above. Is someone logging on my
>>>> system as guest? Running XP Home, DSL with wireless router. Thanks in
>>>> advance, Patrick.
>>> Just to emphasize two things already mentioned by Steve . . .
>>> To answer your question: yes.
>>> Turn on your firewall, and if you have allowed any exceptions
>>> use the scope capability on the exceptions to make sure only
>>> the intended machines (i.e. IPs) are allowed.
>>>
>>>
>> I'm using Zone Alarm firewall. I also share my printer and share folder
>> with my laptop. Does the laptop automatically log on as guest?
>>
>
> "automatically" ??
> depends on how you have things set up.
>
> Do you see the event msgs when the laptop is connected and booted,
> and not see them when it is not ??
>
>
It is true I do see the Laptop logon during the time it is booted up and
connected but looking more at the log I see this at other times:

Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 5/11/2006
Time: 8:54:02 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: MOMS
Description:
Special privileges assigned to new logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

There used to be a program called nuzzler that you could monitor IP's and
traffic but I couldn't get it to work with XP. Is there anything else I
could use?

Patrick
Fri May 12 13:06:07 CDT 2006


"Malke" <notreally@invalid.invalid> wrote in message
news:OAnJZmcdGHA.536@TK2MSFTNGP02.phx.gbl...
> Roger Abell [MVP] wrote:
>
>>> I'm using Zone Alarm firewall. I also share my printer and share
>>> folder
>>> with my laptop. Does the laptop automatically log on as guest?
>>>
>>
>> "automatically" ??
>> depends on how you have things set up.
>>
>> Do you see the event msgs when the laptop is connected and booted,
>> and not see them when it is not ??
>
> Does the laptop run XP Home as well as the Desktop? Home always
> authenticates on the remote system as Guest. If the laptop runs Home,
> you can create an identical user account and password on it to match
> the one(s) on your desktop. Set Zone Alarm to allow traffic from the
> local lan.
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User

The laptop uses ME and I don't have a userid/password setup on it for
convenience. But if that's normal I guess I could live with it?

Patrick
Fri May 12 13:12:17 CDT 2006


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:uv1hpicdGHA.1456@TK2MSFTNGP04.phx.gbl...
>
> "Patrick Casher" <me@privacy.net> wrote in message
> news:bI%8g.25308$4L1.19492@newssvr11.news.prodigy.com...
>>
>> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
>> news:Ow3ahAadGHA.1324@TK2MSFTNGP04.phx.gbl...
>>>
>>> "Patrick Casher" <me@privacy.net> wrote in message
>>> news:U0R8g.4107$fb2.577@newssvr27.news.prodigy.net...
>>>> Event Type: Success Audit
>>>> Event Source: Security
>>>> Event Category: Logon/Logoff
>>>> Event ID: 538
>>>> Date: 5/11/2006
>>>> Time: 1:19:23 PM
>>>> User: MOMS\Guest
>>>> Computer: MOMS
>>>> Description:
>>>> User Logoff:
>>>> User Name: Guest
>>>> Domain: MOMS
>>>> Logon ID: (0x0,0x3FFDBD)
>>>> Logon Type: 3
>>>>
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>> Having multiple entries as shown above. Is someone logging on my
>>>> system as guest? Running XP Home, DSL with wireless router. Thanks in
>>>> advance, Patrick.
>>> Just to emphasize two things already mentioned by Steve . . .
>>> To answer your question: yes.
>>> Turn on your firewall, and if you have allowed any exceptions
>>> use the scope capability on the exceptions to make sure only
>>> the intended machines (i.e. IPs) are allowed.
>>>
>>>
>> I'm using Zone Alarm firewall. I also share my printer and share folder
>> with my laptop. Does the laptop automatically log on as guest?
>>
>
> "automatically" ??
> depends on how you have things set up.
>
> Do you see the event msgs when the laptop is connected and booted,
> and not see them when it is not ??
>
>
It's true I do see the logons about the same time as the laptop is booted.
Looking further into the log I see this at a time when it's idle:

Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 5/11/2006
Time: 8:54:02 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: MOMS
Description:
Special privileges assigned to new logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

There used to be a program called Nuzzler that monitored IPs' and activity
but I couldn't get it to work with XP. Is there anything similar?