Windows Auditing

Tutorials Win: Microsoft Windows Forum

- Previous
  - 1
    - DNS resolution not working Hi, I have a problem with DNS resolution on a few desktops on our network. They randomly stop being able to resolve DNS names within applications other then nslookup. This is what works and doesnt. nslookup: works fine, resolves the host names. ping: fails on resolving the host name, but will ping if ip address is entered. ie: fails on host name, works on ip. Tried ipconfig /flushdns, doesnt fix the problem. But "ipconfig /release & ipconfig /renew" fixes the problem for a while. The DNS is working fine, as nslookup works and other computers on the network are not affected. the problem appears to be location on the desktop, but I am not sure what is causing it, driver problem? I have searched for this and found a few other peopel else where have had a similar problem but no solution was found. Any help would be appriciated. Thanks Tag: Windows Auditing Tag: 287586
  - 2
    - Exclamation mark impossibile to avoid on any nic 8139 I have a great problem on XP Pro Sp2. Notice: Hardware P4 dual and nic realtek 8139 fully working. Tested with any kind of Linux. No virus. No troyan. Tried sfc/scannnow and reinstallation over current XP starting from CD. I've tried everything, even started with UBCD4Win (avoiding the lock on hardware profiles in the registry) and deleting every reg entry I can found bounded to the nic, and every drivers present in the HD, inf, and even from .cab archive cache. I have disabled the nic, installed a new one, and I got the same problem again. I've serched hidden nic, but I don't see any other nic ( Tested various drivers, from the original bounded with the nic (and is for XP) to new realtek update of this year. NOTHING! Everytime I reinstall the nic/driver, everything seems OK, but finally XP says (sorry for traslation because my system is Italian located) that it can find a file. I don't know what file because it says nothing about this file. Every kind of driver i tested say that. Do you have any procedure to check every single step XP do to reach that bad result? A system to debug the problem step, by step finding why Xp end to that result? Tag: Windows Auditing Tag: 287584
  - 3
    - drmsmc port 1878 - what is this? Please if someone could tell me what this "service" is or what drmsmc relates to would be much appreciated. Noticed it connected as a system service using ewido's analysis feature. Thanks Tag: Windows Auditing Tag: 287583
  - 4
    - How to secure your windows XP and network Windows XP could best secure with a new suite of software Secure Auditor. Single IP license just $ 100 which is capable of performing auditing, event log management, windows password auditing, port scanning, windows inventory and asset management, ftp brutforce attack, http bruteforce attack etc. Other modules of this tool are also capable of performing audit on Oracle, MSSQL and Cisco routers with around 30 embedded tools. You know what is the best thing about Secure Auditor is? It provides complete specification and solution of identified vulnerabilities. Just check it out! Download link http://www.download.com/Secure-Auditor/3000-2653-10826743.html?part=dl-SecureAud&subj=uo&tag=button Tag: Windows Auditing Tag: 287582
  - 5
    - can't connect to computer I have a desktop computer and a laptop computer networked together. The desktop is running XP home, the laptop Pro. Both computers see the other one in the "view workgroup computers" and my laptop can access my desktop, but when I try to access the laptop from the desktop I get an error message stating that my laptop is unavailable and I might not have permission to access that resource. Why is this and how can I fix it? Tag: Windows Auditing Tag: 287579
  - 6
    - Wit's End with Networking Here's my deal: I have four computers. One is an iMac hardwired to my Belking router. The other three are laptops--one MacBook and two PC's running XP Pro. All four can access the internet, three of them wirelessly. My Macs can see each other, share files, copy files, etc. I'd like my PC's to do the same. I don't care if the PC's can see the Macs. I'd like to be able to share files between the two PC's, since one is in a remote part of the house. My problem: Everything I've tried, using HP help, Microsoft help and a next door neighbor who claims expertise on PC's has proven unsuccessful. I've put in about six hours on this and I'm where the title of this post suggests. Isn't there a simple way to have these two computers recognize each other? Thanks in advance. Tag: Windows Auditing Tag: 287573
  - 7
    - New connection, have I been hacked I use Live Messenger and a file sent to me was blocked. I have a wireless adapter and connect to my neighbours router (yes she gave me the access code) and I ussualy have a wireless connection logo in the system tray. When I started up the pc the other night I had an extra icon showing a cable connection to another computer. I also now have a modem installed in device manager. I think it is my neighbours computer which I am connecting to but aint to sure as neither of us is experts. The pc is also running much slower now. I'd love to know of anyway of identifying a deliberate attack from someone. Here's what the modem log says. 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\tapisrv.dll, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\unimdm.tsp, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\unimdmat.dll, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\uniplat.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\drivers\modem.sys, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\modemui.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\mdminst.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - Modem type: Communications cable between two computers 04-06-2008 21:59:19.421 - Modem inf path: mdmhayes.inf 04-06-2008 21:59:19.421 - Modem inf section: M2700 04-06-2008 21:59:19.421 - Matching hardware ID: pnpc031 04-06-2008 21:59:19.453 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:19.453 - Initializing modem. 04-06-2008 21:59:19.453 - Waiting for a call. 04-06-2008 21:59:19.484 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:19.484 - Initializing modem. 04-06-2008 21:59:19.484 - Dialing. 04-06-2008 21:59:19.500 - Send: CLIENT 04-06-2008 21:59:21.500 - Timed out waiting for response from modem 04-06-2008 21:59:21.500 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:21.515 - Send: CLIENT 04-06-2008 21:59:23.515 - Timed out waiting for response from modem 04-06-2008 21:59:23.515 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:23.531 - Send: CLIENT 04-06-2008 21:59:25.531 - Timed out waiting for response from modem 04-06-2008 21:59:25.531 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:25.546 - Send: CLIENT 04-06-2008 21:59:27.546 - Timed out waiting for response from modem 04-06-2008 21:59:27.546 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:27.546 - Hanging up the modem. 04-06-2008 21:59:27.546 - Hardware hangup by lowering DTR. 04-06-2008 21:59:29.546 - A timeout has expired waiting to comm event to occour. 04-06-2008 21:59:29.546 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:29.546 - Initializing modem. 04-06-2008 21:59:29.546 - Waiting for a call. 04-06-2008 21:59:29.546 - Session Statistics: 04-06-2008 21:59:29.546 - Reads : 0 bytes 04-06-2008 21:59:29.546 - Writes: 0 bytes I certainly didn't set this up, please help Tag: Windows Auditing Tag: 287568
  - 8
    - New connection appeared, is it a virus I use Live Messenger and a file sent to me was blocked. I have a wireless adapter and connect to my neighbours router (yes she gave me the access code) and I ussualy have a wireless connection logo in the system tray. When I started up the pc the other night I had an extra icon showing a cable connection to another computer. I also now have a modem installed in device manager. I think it is my neighbours computer which I am connecting to but aint to sure as neither of us is experts. The pc is also running much slower now. I'd love to know of anyway of identifying a deliberate attack from someone. Here's what the modem log says. 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\tapisrv.dll, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\unimdm.tsp, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\unimdmat.dll, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\uniplat.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\drivers\modem.sys, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\modemui.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\mdminst.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - Modem type: Communications cable between two computers 04-06-2008 21:59:19.421 - Modem inf path: mdmhayes.inf 04-06-2008 21:59:19.421 - Modem inf section: M2700 04-06-2008 21:59:19.421 - Matching hardware ID: pnpc031 04-06-2008 21:59:19.453 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:19.453 - Initializing modem. 04-06-2008 21:59:19.453 - Waiting for a call. 04-06-2008 21:59:19.484 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:19.484 - Initializing modem. 04-06-2008 21:59:19.484 - Dialing. 04-06-2008 21:59:19.500 - Send: CLIENT 04-06-2008 21:59:21.500 - Timed out waiting for response from modem 04-06-2008 21:59:21.500 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:21.515 - Send: CLIENT 04-06-2008 21:59:23.515 - Timed out waiting for response from modem 04-06-2008 21:59:23.515 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:23.531 - Send: CLIENT 04-06-2008 21:59:25.531 - Timed out waiting for response from modem 04-06-2008 21:59:25.531 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:25.546 - Send: CLIENT 04-06-2008 21:59:27.546 - Timed out waiting for response from modem 04-06-2008 21:59:27.546 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:27.546 - Hanging up the modem. 04-06-2008 21:59:27.546 - Hardware hangup by lowering DTR. 04-06-2008 21:59:29.546 - A timeout has expired waiting to comm event to occour. 04-06-2008 21:59:29.546 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:29.546 - Initializing modem. 04-06-2008 21:59:29.546 - Waiting for a call. 04-06-2008 21:59:29.546 - Session Statistics: 04-06-2008 21:59:29.546 - Reads : 0 bytes 04-06-2008 21:59:29.546 - Writes: 0 bytes I certainly didn't set this up, please help Tag: Windows Auditing Tag: 287567
  - 9
    - How do I know if I've been hacked I use Live Messenger and a file sent to me was blocked. I have a wireless adapter and connect to my neighbours router (yes she gave me the access code) and I ussualy have a wireless connection logo in the system tray. When I started up the pc the other night I had an extra icon showing a cable connection to another computer. I also now have a modem installed in device manager. I think it is my neighbours computer which I am connecting to but aint to sure as neither of us is experts. The pc is also running much slower now. I'd love to know of anyway of identifying a deliberate attack from someone. Here's what the modem log says. 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\tapisrv.dll, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\unimdm.tsp, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\unimdmat.dll, Version 5.1.2600 04-06-2008 21:59:19.375 - File: C:\WINDOWS\system32\uniplat.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\drivers\modem.sys, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\modemui.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - File: C:\WINDOWS\system32\mdminst.dll, Version 5.1.2600 04-06-2008 21:59:19.421 - Modem type: Communications cable between two computers 04-06-2008 21:59:19.421 - Modem inf path: mdmhayes.inf 04-06-2008 21:59:19.421 - Modem inf section: M2700 04-06-2008 21:59:19.421 - Matching hardware ID: pnpc031 04-06-2008 21:59:19.453 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:19.453 - Initializing modem. 04-06-2008 21:59:19.453 - Waiting for a call. 04-06-2008 21:59:19.484 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:19.484 - Initializing modem. 04-06-2008 21:59:19.484 - Dialing. 04-06-2008 21:59:19.500 - Send: CLIENT 04-06-2008 21:59:21.500 - Timed out waiting for response from modem 04-06-2008 21:59:21.500 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:21.515 - Send: CLIENT 04-06-2008 21:59:23.515 - Timed out waiting for response from modem 04-06-2008 21:59:23.515 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:23.531 - Send: CLIENT 04-06-2008 21:59:25.531 - Timed out waiting for response from modem 04-06-2008 21:59:25.531 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:25.546 - Send: CLIENT 04-06-2008 21:59:27.546 - Timed out waiting for response from modem 04-06-2008 21:59:27.546 - Failed to send command because of WriteFile() Failure, Error=000003e3. 04-06-2008 21:59:27.546 - Hanging up the modem. 04-06-2008 21:59:27.546 - Hardware hangup by lowering DTR. 04-06-2008 21:59:29.546 - A timeout has expired waiting to comm event to occour. 04-06-2008 21:59:29.546 - 19200,8,N,1, ctsfl=1, rtsctl=2 04-06-2008 21:59:29.546 - Initializing modem. 04-06-2008 21:59:29.546 - Waiting for a call. 04-06-2008 21:59:29.546 - Session Statistics: 04-06-2008 21:59:29.546 - Reads : 0 bytes 04-06-2008 21:59:29.546 - Writes: 0 bytes I certainly didn't set this up, please help Tag: Windows Auditing Tag: 287566
  - 10
    - Can't ping my PC from the internet My PC has two network cards... One is an onboard gigabit connected to my LAN. The LAN is connected to a router, as are other PCs on my LAN. The router is connected to a cable modem. The second NIC is a 10/100mbit PCI card connected directly to another cable modem. The GigE NIC is hardcoded to an IP on my private network with the following settings: IP: 10.0.11.16 Mask: 255.255.255.0 DNS: 10.0.11.1, 64.59.135.143 Gateway: 10.0.11.1 Gateway metric: 100 (previously auto) Interface metric: 100 (previously auto) The 10/100 NIC pulls a dynamic IP from my cable internet provider and currently has the following settings: IP: 68.145.38.197 Mask: 255.255.255.0 DNS: 64.59.135.143, 64.59.135.145 Gateway: 68.145.36.1 Gateway metric: auto Interface metric: auto The router is configured with my private network info on the LAN side and dynamic settings pulled from my cable internet provider on the WAN side. Currently configured as follows: LAN side... IP: 10.0.11.1 Mask: 255.255.255.0 Gateway: 10.0.11.1 WAN side: IP: 68.145.78.218 DNS: 64.59.135.143 Gateway: 68.145.76.1 At this point I'm unable to connect to any services on the 100mb port, and up until my last settings changes and reboot I was not even able to ping the 100mb port. My last change was to put the gateway and interface metrics on the GigE port to 100 to ensure any remote traffic was going through that interface, and to keep my local LAN traffic on the GigE interface. I believe I should not have applied a metric to the GigE interface though. At this point I cannot connect to any services on either port. Before my last settings change I was able to connect the the remote desktop through the GigE interface, but not any longer. What I am trying to do: - Any PC on my LAN, except this one, should use the internet connection through the router. - This PC should pass local LAN traffic over the GigE port only. - This PC should pass internet traffic over the 100mb port only. The PC's on my LAN are all hardcoded for the 10.0.11.0/24 network. Gateway is 10.0.11.1. This appears to be working. This PC does not consistantly pass it's internet traffic through the 100mb port. I've tried removing the gateway IP from the GigE port, changing the gateway metric to 100, and finally the interface metric to 100. What should I be doing to make this work??? Tag: Windows Auditing Tag: 287555
  - 11
    - domain not visible some time after system start Hi, we have a small network with a NT domain. A XP Home SP2 computer - it was not my decision to put a Home edition on the network - has to access a shared printer on another PC. All other computers can access the shared printer on this PC so that I think that the only problem is this XP home computer. The problem is that this XP home PC does not see the NT domain after a system start. But after some time the domain is visible with net view /domain. The fact that the NT domain is not visible during startup results in a failing net use lpt2: \\PC_with_the _shared_printe\shared_printer r command. The first thing what I discovered is that ipconfig /all shows the node type as "unknown". The solution of Microsoft is to set the EnableProxy value in the registry to 0 or 1 (http://support.microsoft.com/kb/310570/en-us). This has no effect on this PC, the node type is still "unknown". I could not find a second solution. Also PCuck's Website has only this solution (http://networking.nitecruzr.net/2005/05/address-resolution-on-lan.html). Because the importance of a clean name resolution is often stressed I want to have a clear value here. What I have to do? The second thing is that browstat status shows: Status for domain ktsntdom on transport \Device\NetBT_Tcpip_{0094402A-76BF-48C6-B6B3-1B5BAD6C72FA} Browsing is active on domain. Master browser name is: KTS9 Could not connect to registry, error = 5 Unable to determine build of browser master: 5 Unable to determine server information for browser master: 5 2 backup servers retrieved from master KTS9 \\HOME \\KTS9 There are 8 servers in domain ktsntdom on transport \Device\NetBT_Tcpip_{0094402A-76BF-48C6-B6B3-1B5BAD6C72FA} There are 2 domains in domain ktsntdom on transport \Device\NetBT_Tcpip_{0094402A-76BF-48C6-B6B3-1B5BAD6C72FA} KTS9 is a NT server so that we don't have Guest authentication here what could cause the error = 5. Because none of the other computers show this error with browstat, firewall and antivirus problems can be excluded on the master browser, I think. I looked up the restrictanonymous setting on KTS9 - it was not set. A browser conflict should be detectable with the output of browstat. So I have checked all points from PChuck's website (http://networking.nitecruzr.net/2005/06/mysterious-error-5-aka-access-denied.html). What else could cause this error? What can cause the delay until the NT domain is detected? No other computer has that delay! Sorry for still not migrating to AD but I want to wait for a stable Windows Server 2008. I t was not really necessary to migrate for me. Thanks a lot. Uwe Tag: Windows Auditing Tag: 287552
  - 12
    - File and Printer Sharing I have Windows XP connected by a simple cross-over CAT5 cable to a computer with Windows ME. I am extremely frustrated, in that the detailed Microsoft instructions constantly divert me to connecting the other (ME) computer to the Internet. To heck with the Internet, I want to share my files and printer with the ME computer, and eventually to make the ME computer the host and reverse the sharing. I can ping the ME computer from the XP and get a good response. Invoking My Network Places doesn't show the ME computer from the XP computer and vice-versa. Where the heck are the instructions / Wizard that lets me GO FORWARD to share files and printer? HELP! Tag: Windows Auditing Tag: 287546
  - 13
    - Keep losing access to network Hi, Hope some of you experts can help me with this one. I have a simple network set up of 8 machines. I am using Machine #1 as a basic "file server". I have the Workgroup all set up and everything is working fine. But.... for some reason, every now and then the network will not let my users in when they try to access it. It's like a configuration or a permission or something just disppears or dies. And, today, for some reason, I can't even access the Network from my main machine (Machine #1). Each of my users are getting the error message, Unable to access the network.. you might not have permissions... etc". This just seems so rediculous to me as it was working just fine a day ago. We had done nothing to any of the systems to change anything. I even went in and tried to "repair" the network connection, but it didn't help. It's all out there, it just won't let some of my machines connect which used to. So, I am hoping one of you experts has the quick solution to this. Thanks! avi Tag: Windows Auditing Tag: 287541
  - 14
    - XP home network stopped working I need some help as I have run out of ideas. I have a simple XP Home network consisting of a desktop with 2 harddrives and a laptop with both wired and wireless connections. I have had 2 changes to my network lately and I can't figure out which one (or both) caused the problem. 1. I recently reformatted the desktop and reinstalled XP, when I did this I chose a new name for my computer. 2. I installed comodo firewall and avast a/v on the laptop, was not happy with them and uninstalled both, i now run AVG a/v and the windows firewall on both machines. The Problem: I ran the network setup wizard on both machines with MSHOME as the workgroup. I can access the laptop via the desktop through "view workgroup computers" without a problem. On the laptop I mapped over to the desktop's second harddrive so I can store photos, etc there. This mapping disconnects after a while and if I ping the desktop the mapping will work again for a while then repeats the cycle. I can browse to the desktop by putting the name into Explorer. Also on the laptop I cannot see the 2 computers in "view workgroup computers", I either get an error saying "the network path was not found" or "the list of servers for this workgroup is not currently available" What I have done so far: I have run the network wizard several times I dloaded the resource kit, opened command shell and typed ntrights +r SeNetworkLogonRight -u Guest ntrights -r SeDenyNetworkLogonRight -u Guest ntrights +r SeNetworkLogonRight -g Everyone ntrights -r SeDenyNetworkLogonRight -g Everyone Restrictanonymous is set to 0 on both machines I disabled the computer browser service on the laptop Both are running XP Home sp2, I am focusing on the laptop more because the errors occur when trying to browse to the desktop, should I be focusing on the desktop instead? I just want to be able to share the second drive and print to the desktop's printer but the mapping keeps failing on me then a ping will bring it back for a while. Thanks for your help Tag: Windows Auditing Tag: 287531
  - 15
    - Workgroup, I can' t access computers by name without prompt passwo Hello, I had install some workgroups with a mchine with xp pro as share server, sometimes I can access computer without prompt user and password. Other times when i change computer server, same windows xp pro, in the workgroup correct, he keep asking user and password to access shares. Someone have one idea, if i'm missing something? Could be some update? I only can solve this with a net use at the startup, but i would wonder if i have change any policy, start service or install update? thanks, regards. Pedro Tag: Windows Auditing Tag: 287530
  - 16
    - reinstalling network How can I uninstall my network and reset it up? the computer used to set it up is no longer attatched to the network and i cannot change settings for wireless etc. I have learned how to setup the network from scratch, but cannot remove existing setup. help -- Scott Tag: Windows Auditing Tag: 287529
  - 17
    - GET ME OFF MY DOMAIN!!! So I decided I wanted to set up a network for my wife and I to both use my printer without her having to find and install the printer software. It didn't work as well as I wanted it to and it left me with this old version of Windows schemes and no picture in my Start Menu. I read a couple articles on this and it said if your computer belongs to a domain/network you can not get a picture and it is in some kind of safe-mode. So how do I get off of the domain? Tag: Windows Auditing Tag: 287525
  - 18
    - Printing across workgroups HI, Is it possible to print to a printer on another workgroup? My PC is on the same subnet and I am able to ping the PC connected to the printer. Obviously i am not able to browse the printer but is there a way i can configure the printer using IP address? Thanks for any help. Ramesh Tag: Windows Auditing Tag: 287524
  - 19
    - Dynamic DNS client for Windows? In my Windows PC I have three network cards. They pull dynamic IP addresses from my ISP. I already have a domain registered at zoneedit.com, with the necessary A records for each network connection. Now I'm looking for a Dynamic DNS client to run as a service on my Windows machine that will automatically update ZoneEdit whenever an IP changes on any of my three network cards. I was doing this successfully about a year ago, but I cannot remember what client software I used at that time. Google finds a few DDNS clients out there, but they won't handle multiple network cards, or aren't free, or just don't make sense when it comes to configuration. Can someone suggest a good DDNS client that would meet my needs? Tag: Windows Auditing Tag: 287513
  - 20
    - wireless and ethernet connection for the same laptop I have a laptop with WiFi and I use it whereever there's wireless and at home. However, recently while I was travelling I had to connect to the hotel internet facility with a network cable (ethernet) but I couldn't get any connection. At home my laptop has a fixed IP-address (with its Mac address) and its included in the router as a wireless node. When I check my I394 connection I see "connected" with 400mbps ! But no of bytes being exchanged in 0. Can anybody please let me know how I can get internet connection using the ethernet cable ? Tag: Windows Auditing Tag: 287506
  - 21
    - Help!!! about tcp performance Hi, I have set all the registry, and can see the big window size in packets when file trans.But the speed seemed no change.When I copy file from remote server(4M Line),it still costed many more time than in vista. HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\GlobalMaxTcpWindowSize HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\TCPWindowSize HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interface\InterfaceGUID\TCPWindowSize Did it not implement said in the doc http://technet.microsoft.com/en-us/magazine/cc162519.aspx WHY??? Tag: Windows Auditing Tag: 287504
  - 22
    - Windows Built in Firewall... Howdy Folks, I have a user whos built in windows firewall is actually blocking the XP VPN client from making outgoing VPN connections. I have never before seen this behavior on the XP firewall. When the firewall is turned off the VPN goes through just fine, when it is turned on the VPN cannot establish any kind of connection. I have never come across this type of behavior with microsofts built in firewall conflicting with the default XP vpn client. Any thoughts? Tag: Windows Auditing Tag: 287503
  - 23
    - SLOW file copy? I have a gigabit LAN here. My machine is running Win XP Pro SP2. The other machine is running Windows 2003 R2 Server. Source drive is a 320gig Seagate SATA drive on the onboard nVidia SATA controller. It's running in 3gig mode. Target drive is actually a RAID5 array. Five 500gig SATA hard drives with lots of space to spare. When I copy a large file (4+ gig) the network utilization is less than THREE percent. This works out to about 30mbit/second or about 3.8mbyte/second. Performance is MUCH worse when transferring small files. I just downloaded NetCPS and tested the throughput of my LAN directly and utilization tops out at about 60%. This works out to 600mbit/second or 75mbyte/second. Where is all the performance being lost???? Tag: Windows Auditing Tag: 287502
  - 24
    - Insufficient system resources... "Insufficient system resources exist to complete the requested operation." I just started getting this error on a machine with XP Pro SP2 connected to my W2K domain whenever you try to access a network drive in Explorer or My Computer. Interestingly, I am able to use the network drive e.g. to install software by using Start | Run. The computer has 512MB RAM, and nowhere near all of it is being used. Swap file size is set to 648-1344MB in size. I tried searching on MS (Live search blows!) but the results I got back were all about Vista. One reason our company has not taken the Vista "plunge". No other XP Pro machines on our network are experiencing this issue. The network drive is our fileserver (W2K3 Standard) with a 750GB drive. Any ideas appreciated! Tag: Windows Auditing Tag: 287499
  - 25
    - No clock synchronization Hello: I get the following warning for both time.nist.gov and, earlier, time.windows.com: Event Type: Warning Event Source: W32Time Event Category: None Event ID: 36 Date: 4/7/2008 Time: 12:55:49 PM User: N/A Computer: HANS Description: The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. When I did "Update Now" (Win XP Home) , I got an error message for time.nist.gov , but a successful synchronization for time.windows.com. I'm not sure I understand the message "The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp.". Can anyone explain it. I understand that this can also be a fire wall issue (I have Nortin Internet SecuritY). While I know that the service is called "Windows Time", I am not sure how to enable nist.gov (and I do not expect anyone here to know, since this is not a Norton site, but if you know, I would appreciate a hint). The time service is shown to start automatically, but, obviously, it times out. Any help would be appreciated. Regards Hans L Tag: Windows Auditing Tag: 287498
- Next
  - 1
    - Effect of Jumbo frames on 100mbit network? Most of the equipment on my LAN is running at 1000mbit/sec. I'd like to take advantage of Jumbo Frames. I have no problem setting this up on my PC's, but I'd like to know what kind of effect it will have on devices that are only 100mbit/sec capable, like my cable modem or old laptop? Tag: Windows Auditing Tag: 287497
  - 2
    - Mapped network drives showing in applications but not explorer All, Wondering if someone could share some wisdom on this matter i have. On my machine at present i'm linked to two different network drives, one for the company shared documents and the other for personal work. If i try and open files from either of these drives within an application (i.e. Excel) i can browse files and open them fine. However, if i open an Explorer window these drives do not appear. Can anyone assist? Thanks, Tom. Tag: Windows Auditing Tag: 287495
  - 3
    - Pinging 192.168.1.x IP address returns wrong IP I have a couple Windows XP Pro machines with most of the updates. I have 12 of them at remote locations. I am using Netgear's VPN client to connect to the main office for the remote locations to enter their accounting data. This has worked pretty well on several PCs. However, on a few of them, when I ping any address at 192.168.1.x, it will return ping results for 10.44.something. I don't remember the exact IP address. I did google the IP address just in case but I didn't come up with anything good. I noticed this on two machines after installing the VPN client. Interestingly enough, it happens both when connected and disconnected from the VPN. My first thought was spyware. I used ad aware and spybot on the machines with caught a little..nothing significant. But didn't fix anything. I used this WinXP TCP/IP fix program that I found on the web. I like using it for certain spyware that screws up the protocol in some way. But that did nothing. I'm pretty good at eradicating most destructive spyware. Somehow though, I still think it's spyware...but I almost want to blame the VPN software. I actually uninstalled the VPN software on one of the machines to make sure the problem would still exist. It still returned the wrong address. So, I'm stuck. I'm not sure what troubleshooting there is left to do. Pinging an IP address to me seems like the most basic test to see if TCP/IP is working. I would assume it's not DNS...since pinging an IP address shouldn't query a DNS server. Does anyone have any suggestions on what to do next? Thank you! Gary Tag: Windows Auditing Tag: 287489
  - 4
    - Home network and file sharing Hello Everybody, My desktop has WinXP Pro SP2 while my brother's laptop has WinXP Home. Both computers have multiple user accounts for different family members. We both share internet by using a wireless router. My brother has his accounts on both, desktop and laptop, computers. Is it possible (in a home network setup) that my brother can access only his account on desktop from his laptop? If yes then how? I have been searching this on internet for weeks but no luck so far. Thank you, -- Syed Zeeshan Haider Tag: Windows Auditing Tag: 287487
  - 5
    - Slow Network Logon Hello. I hope someone can help with the issues I have. Im having problems with machines taking up to 20 minutes to logon to the network, this does not affect all machines just random ones.(most machines) We have used a network sniffer to look at the traffic from the client machines and for some reason the client authenticates fine with the local domain controller, and know which site it is in, but then goes off talking to other domain controllers around the world in other sites. Im not sure if this is when it is trying to pull down the group policy, does anyone know why this would happen? Also if I ping my domain name the reply changes every so often, and its always from a DC in another country site, if we add a host entry for the local DC to the domain name it fixes the issues on some machines. Also on almost all machine I get the error in the event log "The Security System could not establish a secured connection with the server DNS/blah.blah.blah.com. No authentication protocol was available." What does this mean? I know that's all a bit random so any help would be appreciated. Thanks Tag: Windows Auditing Tag: 287481
  - 6
    - Networking process causes continuous hard drive activity I don't know is this info below is usable - I got from the Sysinternals Process Monitor. Sometimes it continues for hours. I saw my Hard drive constantly be used and tried this Process Monitor to figure it out - to hopefully stop it. But it's beyond my knowledge. You can see it repeats itself... Does anyone know what's going on and how to stop it? Thanks. Using XP... 50214 9:51:52.8527885 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50215 9:51:52.8528010 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50216 9:51:52.8528089 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 414, Data: \Device\ {F458D970-5D74-4333-9BE8-5B6912F61F49}, \Device \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}, \Device\{B8616C2E-4CEC-4744- A927-806C97ACCA24}, \Device\{0A0F0B98-8C0F-411E-AB8A-62225DDC3B35}, \Device\NdisWanIp 50221 9:51:52.8529681 PM Explorer.EXE 1896 RegOpenKey HKLM\SYSTEM \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS Desired Access: Read 50222 9:51:52.8529941 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\EnableDHCP SUCCESS Type: REG_DWORD, Length: 4, Data: 1 50223 9:51:52.8530053 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\LeaseObtainedTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1207619106 50224 9:51:52.8530156 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\LeaseTerminatesTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1207705506 50225 9:51:52.8530254 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.2.1 50226 9:51:52.8530349 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.2.1 50227 9:51:52.8530488 PM Explorer.EXE 1896 RegCloseKey HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS 50228 9:51:52.8531086 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50229 9:51:52.8531173 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50230 9:51:52.8531245 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 414, Data: \Device\ {F458D970-5D74-4333-9BE8-5B6912F61F49}, \Device \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}, \Device\{B8616C2E-4CEC-4744- A927-806C97ACCA24}, \Device\{0A0F0B98-8C0F-411E-AB8A-62225DDC3B35}, \Device\NdisWanIp 50235 9:51:52.8532952 PM Explorer.EXE 1896 RegOpenKey HKLM\SYSTEM \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS Desired Access: Read 50236 9:51:52.8533156 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\EnableDHCP SUCCESS Type: REG_DWORD, Length: 4, Data: 1 50237 9:51:52.8533254 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\LeaseObtainedTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1207619106 50238 9:51:52.8533349 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\LeaseTerminatesTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1207705506 50239 9:51:52.8533450 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.2.1 50240 9:51:52.8533545 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.2.1 50241 9:51:52.8533667 PM Explorer.EXE 1896 RegCloseKey HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS 50242 9:51:52.8533927 PM Explorer.EXE 1896 RegOpenKey HKLM\SYSTEM \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS Desired Access: Query Value 50243 9:51:52.8534112 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\AddressType SUCCESS Type: REG_DWORD, Length: 4, Data: 0 50244 9:51:52.8534232 PM Explorer.EXE 1896 RegCloseKey HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS 50245 9:51:53.8528516 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50246 9:51:53.8528631 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50247 9:51:53.8528709 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 414, Data: \Device\ {F458D970-5D74-4333-9BE8-5B6912F61F49}, \Device \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}, \Device\{B8616C2E-4CEC-4744- A927-806C97ACCA24}, \Device\{0A0F0B98-8C0F-411E-AB8A-62225DDC3B35}, \Device\NdisWanIp 50252 9:51:53.8530142 PM Explorer.EXE 1896 RegOpenKey HKLM\SYSTEM \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS Desired Access: Read 50253 9:51:53.8530360 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\EnableDHCP SUCCESS Type: REG_DWORD, Length: 4, Data: 1 50254 9:51:53.8530463 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\LeaseObtainedTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1207619106 50255 9:51:53.8530561 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\LeaseTerminatesTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1207705506 50256 9:51:53.8530659 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.2.1 50257 9:51:53.8530751 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.2.1 50258 9:51:53.8530877 PM Explorer.EXE 1896 RegCloseKey HKLM\System \CurrentControlSet\Services\Tcpip\Parameters\Interfaces \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50} SUCCESS 50259 9:51:53.8531410 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50260 9:51:53.8531494 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind BUFFER OVERFLOW Length: 144 50261 9:51:53.8531572 PM Explorer.EXE 1896 RegQueryValue HKLM\System \CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 414, Data: \Device\ {F458D970-5D74-4333-9BE8-5B6912F61F49}, \Device \{2D663155-75E9-4CAD-83EA-49FDE3D7BE50}, \Device\{B8616C2E-4CEC-4744- A927-806C97ACCA24}, \Device\{0A0F0B98-8C0F-411E-AB8A-62225DDC3B35}, \Device\NdisWanIp Tag: Windows Auditing Tag: 287473
  - 7
    - Slow Network Browsing - MS Office Hi there, We have a small network, w2k Server and a combination of win xp Pro desktops and notebooks all with MS Office 2003. One of the notebooks seems to freeze up for a minute when trying to browse for an attachment using Outlook, and will regularly do the same when browsing for files from Word or Excel. It doesn't seem to make a difference if connected via wireless (54Mb) or wired (100Mb) If the network is disabled. you can browse through directories with no problem, but of course no network drive. Since this is happening only on this PC I don't think it's a Server issue? Am I wrong in assuming this? I would like to just format the drive and load the OS fresh. Is there something else I should look at first? Virus patterns are up to date and a scan reports clean, using Norman Virus Control. Thanks for the input... Bob Tag: Windows Auditing Tag: 287468
  - 8
    - block network browse hi I m new to this group , I have a querry that I have one net LAN connection and I have made ICS for my other PC via LAN card .Now I want block/restrict some sites/browsing of my client PC, so how can I do this plz suggest me . thanks Tag: Windows Auditing Tag: 287466
  - 9
    - Authentication prompt when UNC into XP Pro machine from Win2K mach I have two cilent machines in a peer to peer network. One is a Win2K box (Client1) and another is a XP Pro box(Client2). They are on the same subnet mask and are able to ping each other. I have both firewalls turned off and have ensured that file sharing is enabled on both machines. Both admin accounts are named differently and currently have different passwords assigned to them. I can UNC into the Windows 2000 box from the XP Pro box without any authentication popups and can view any shares to include printers. However, when I attempt to UNC into the XP Pro box from the Win2K box, i get prompted for Authentication. On both machines, I set Digitally Sign Server/Client communications (when possible) to enabled and Digitall Sign Server/Client communications (Always) to disabled. Also I set Secure Channel: Digitally encrypt/sign secure channel data (when possible) to enabled and (Always) to disabled. My NTLM settings are Send LM and NTLM-User NTLMv2 when possible. My big question is do I have to set up like users with the same passwords on both systems in order to avoid the authentication? I know this will work, but am looking to avoid that if at all possible. Also if anyone could tell me how I am able to UNC into the Win2K box without authentication while I get hit with it UNCing into XP from Win2K, that would be excellent as well. Thank You, Boe Tag: Windows Auditing Tag: 287463
  - 10
    - Local Area Connection Icon hi every body I 'd like to share with u something really weird recently cought by glancing accidentally to the right down corner in my laptop screen... the lac icon has got a bigger X than that supposed to be I've tried to compare with my other PC and the different is unquestioned. and now I'm little bother by this... actually by the factor that might replace the Icon cause if its might replace it G-D knows what else has been replaced by this virus/trojan/malware... and i don't know what else PLZ help Tag: Windows Auditing Tag: 287456
  - 11
    - Access Denied, XP pro, SP2 5 machnes , Simple File and Printer Share Like Ron, several posts back, We have been running 5 machines on XP for 4 years with no problems. Then, all of a sudden last Fri afternoon the other 4 machines could not print to a dot matrix printer located on Problem XP. This printer is set up on LPT2 and everyone else redirects the output of their machine to lpt2 (NET USE LPT2: \\BRAD\SERVICE /PERSISTENT:YES). While trying to figure out why this was happening, I discovered that the problem XP machine could see and read all files on the other machines (that had shared folders) but even though they could see the shared folders on the problem XP, they could not open them. I also getthe "Access Denied... You might not have the permission......." error. Unlike Ron, We are just using the simple file share on all machines. I have turned off the Firewall (just to test if that was the problem - I already had the XP firewall off, we are using CA) I have made no changes to the system. I can ping this machine from all the others and again, I can see the shared folders on the probem machine from the others but can not access them. What else should I be checking for? I am hoping that whatever is going on will also let everyone print to the problem XP again after this issue is resolved. thanks ahead of time Tag: Windows Auditing Tag: 287453
  - 12
    - Error 80042109 on sending mails Hi Freaks For a few weeks, I couldn't send emails :-( The error message is "Error 80042109 Outlook is unable to connect to your outgoing SMTP server" So I did ask GMX, G-DATA, my internet provider, ... but no one can tell what's going on. GMX told me to switch of the (Window) firewall, no result. Then I start the (windows) firewall logfile and got this: ------------------------------------------------------------------------------------- 2008-04-07 20:57:24 OPEN TCP 192.168.1.33 208.50.223.240 3187 80 - - - - - - - - - 2008-04-07 20:57:24 CLOSE TCP 192.168.1.33 208.50.223.240 3187 80 - - - - - - - - - 2008-04-07 20:57:34 OPEN TCP 192.168.1.33 213.165.64.21 3188 587 - - - - - - - - - 2008-04-07 20:57:34 CLOSE TCP 192.168.1.33 213.165.64.21 3188 587 - - - - - - - - - 2008-04-07 20:57:34 OPEN TCP 192.168.1.33 213.165.64.21 3188 587 - - - - - - - - - 2008-04-07 20:57:34 OPEN TCP 192.168.1.33 213.165.64.22 3190 110 - - - - - - - - - 2008-04-07 20:57:34 CLOSE TCP 192.168.1.33 213.165.64.21 3188 587 - - - - - - - - - 2008-04-07 20:57:34 DROP TCP 213.165.64.21 192.168.1.33 587 3188 40 A 3429721974 3955125903 5840 - - - RECEIVE 2008-04-07 20:57:37 DROP TCP 213.165.64.21 192.168.1.33 587 3188 48 SA 3429721973 3955125903 5840 - - - RECEIVE 2008-04-07 20:57:43 DROP TCP 213.165.64.21 192.168.1.33 587 3188 48 SA 3429721973 3955125903 5840 - - - RECEIVE 2008-04-07 20:57:54 OPEN TCP 192.168.1.33 208.50.223.240 3191 80 - - - - - - - - - 2008-04-07 20:57:54 CLOSE TCP 192.168.1.33 208.50.223.240 3191 80 - - - - - - - - - 2008-04-07 20:57:55 DROP TCP 213.165.64.21 192.168.1.33 587 3188 48 SA 3429721973 3955125903 5840 - - - RECEIVE 2008-04-07 20:58:19 DROP TCP 213.165.64.21 192.168.1.33 587 3188 48 SA 3429721973 3955125903 5840 - - - RECEIVE 2008-04-07 20:58:24 OPEN TCP 192.168.1.33 208.50.223.240 3192 80 - - - - - - - - - 2008-04-07 20:58:25 CLOSE TCP 192.168.1.33 208.50.223.240 3192 80 - - - - - - - - - 2008-04-07 20:58:26 OPEN TCP 192.168.1.33 213.165.64.22 3194 110 - - - - - - - - - 2008-04-07 20:58:26 OPEN TCP 192.168.1.33 213.165.64.21 3195 587 - - - - - - - - - 2008-04-07 20:58:26 CLOSE TCP 192.168.1.33 213.165.64.21 3195 587 - - - - - - - - - 2008-04-07 20:58:28 CLOSE TCP 192.168.1.33 213.165.64.22 3194 110 - - - - - - - - - ------------------------------------------------------------------------------------- Aha, there are DROPs Try to open the port 587: no connection at all Does anyone do have any idea what's going on? BTW 1: I did try Thunderbird: Same problem BTW 2: OS Windows XP Pro SP2 regards Ingo Tag: Windows Auditing Tag: 287452
  - 13
    - Windows Firewall Weirdness on Multi-Home Machine My laptop is running XPSP2 with all updates. It has an Intel 2915abg WNIC (named WIRELESS) and a Intel Pro/100VE (named WIRED). For exceptions, I have "File and Printer Sharing", "Network Diagnostics for Windows XP", "Remote Assistance", "Remote Desktop", and "Windows Live Messenger". From another computer, I can ping WIRED, but not WIRELESS. Under the Advanced tab, if I disable firewall on WIRELESS, it still doesn't work. However, if I leave it enabled on WIRELESS and disable the firewall on WIRED, suddenly, I can see WIRELESS from the other computer. I went into "ICMP settings" and made sure that "Allow incoming echo request" was selected. If I completely disable WIRED, then WIRELESS works perfectly. Why would enabling or disabling the firewall on the other NIC matter? Another data point is that SMB (File and Printer Sharing) works regardless of whether the firewall is enabled on either card as long as the exception for it is enabled. I don't really care of I can ping this machine or not, but Remote Desktop also doesn't work when I try to connect using the WIRELESS IP when the firewall is active on WIRED. Tag: Windows Auditing Tag: 287450
  - 14
    - Workgroup Problem... Please Help! Hi, I have 6 laptops all the same model, I am connecting them through a standard netgear switch (no DHCP). The TCP/IP configuration is as follows: Laptop1 - 192.168.0.2 Laptop2 - 192.168.0.3 Laptop3 - 192.168.0.4 Laptop4 - 192.168.0.5 Laptop5 - 192.168.0.6 Laptop6 - 192.168.0.7 The subnet mask for all are 255.255.255.0, I havenâ??t set any gateway or dns configuration. Each has the same Workgroup name. The purpose of the workgroup is to use ICS so all 6 can share the internet connection which will be using a express card mobile broadband service. I can ping all computers, I can see 5 computers but not one, itâ??s as if its holding a token and wont display, if I turn the computer off that is unable to be seen or see any of the other computers the workgroup stops working... this is really frustrating, does anyone know what I have done wrong? ICS and express card has not been enabled or installed at this point as I want to get the workgroup working and reliable! Tag: Windows Auditing Tag: 287437
  - 15
    - I lost my user profile! What to do?!?!?! Hi All. Please help - I just lost my user profile in WinXP. I logged in as usual with domain user - DOMAX\dmitry_b but everything I had configured disapeared! :-((( No mail accounts, no my settings, only default windows theme, no links to applications I added, etc. Examining environement (command "set" in "cmd.exe") I found that path to current user profile is not "C:\Documents and Settings\dmitry_b\" but the "C:\Documents and Settings\TEMP\" !!! Perhaps it is the reason why I lost all my settings - Windows not linked my exiting profie folder - dmitry_b with me. But why?! From day to day I logged in with the same user and all was fine. Yesterday evening I worked - all was fine. But now... WHY AND HOW IT COULD HAPPENED?! AND WHAT TO DO WITH IT NOW? Help me please. I do not want to lost lot of time configuring lot of things again... Any - why Windows done such thing? Regards, Dmitry. Tag: Windows Auditing Tag: 287432
  - 16
    - Access Denied, XP Pro, SP2, Peer to Peer LAN Hi Running Win XP pro SP2 on 4 machines,,, peer to peer LAN (workgroup) My problem is, I can not connect to any of the shared folders Iâ??ve created on one of the machines from any of the other machines. Each machine can open any of the default Shared Doc folders for each of the users of all the machines. The machine that will not grant permission to view (open) any of its folders I have shared on the network can view (open) all the shared folders on all of the other machines. I first noticed the problem after installing a second license of QBooks on one of the machines. When trying to point QBâ??s to the company files on the host machine Iâ??d get this,,,, â??â??â?? \\ blah blah\shared folder name is not accessible. You might not have permission to use this network resource. Contact the admin of this server to find out if you have access permissionsâ?¦. Access is deniedâ??â??â??â?? Also,,, not sure if this has anything to do with it, but,,, the machine with the second seat of QB, in the My Network Places folder is listing all the shared folders not on that machine as located on The Internet and not on the Local Network as it should,,,,,,,, Man am I confused!!!!!!! Ray Tag: Windows Auditing Tag: 287430
  - 17
    - Internet connectivity I have a wired land connection through a cable modem on my home PC. I don't have a router. I have a friend's laptop and am unable to get a wireless connection in my area. I am trying to use my wired PC connection but am unable to connect. It says it's connected but I can't get online. Do I have to assign separate metric numbers or.......? Thanks - help is appreciated! -- Debbie Nuciforo Tag: Windows Auditing Tag: 287429
  - 18
    - Networking without internet using wireless router I have a desktop and a laptop both with wireless internet running XP Pro. Iâ??m connecting through a free hotspot when I want to go online. I also have a Linksys WRT54G router. Iâ??d like to network both computers together using the router to share files and a printer. Iâ??m having problems installing the routerâ??s CD because it wonâ??t let me move on without connecting it to the internet. Is it possible to use this router to do this without connecting it directly to the internet? If so how do I enable this? Tag: Windows Auditing Tag: 287421
  - 19
    - Networking - Access denied to shared folders Windows Vista Premium & XP Home network comprising wireless router, old desktop XP PC and one new Vista laptop cable-connected to router, plus 2 laptops wireless-only connected. When I click "View Network Computers" from the cable connected laptop, the old XP desktop PC I want to access (call it "PROBLEMPC") appears in the Network map/liist but when I double-click on almost all of the folders I get an Access Denied message. That PROBLEMPC is ethernet-cable plugged in to the wireless router - the new vista laptop is also ethernet cable connected to the router. Each computer has three users. I can access my folders on the old xp pc - but not the folders of the other 2 users - even though they have been set up for sharing. So there obviously is a connection, all I want to do is access PROBLEMPC in the normal way through the network. Any ideas? Tag: Windows Auditing Tag: 287420
  - 20
    - ?? Weird: Cannot Connect using Routable IP ?? Hello all, Sorry about the cross-posting but I'm not sure of the best group. If you have any suggestions for a better group, please let me know. The problem I'm having is easy to describe: I have a home network that's behind a router. I have set up one of my machines to be a web server and I've configured the firewall to point to this machine for incoming requests on port 80. Using a web browser, I can browse to the router's IP address and sure enough, I'm forwarded to my web server, it works great, but only if I am NOT on my local network! For example, if I am at work or at the coffee shop, I *can* browse to my router's IP address and I see the web page. If, however, I am at home, behind the firewall, I *cannot * use my router's IP. From home I have to use the web server's local IP: http://192.168.254.68. Can someone explain what's going here? Why can I only use the router's IP if I am outside my network? Here's the configuration: Web Server Machine: Virtual machine running Windows Server 2008, IIS 7 Web Browser Machine: XP Pro running IE 7 Thanks very much. -- Tom Baxter Tag: Windows Auditing Tag: 287402
  - 21
    - Connecting two routers and Computers, One 192. and One 10. Hello all, I hope someone can help me with this one, I guess I forgot basic networking. I have one Netgear router plugged into a cable modem (I pay extra for the cable modem to have a static IP address) the Netgear is 192.168.0.0/24 I have a Netgear wireless router connected to the Netgear (if the NG wireless is plugged directly into the NG router it will take the static IP address) NG Wireless is 10.0.0.0/24 One computer gets a 192. address from the Netgear router. One computer gets a 10. from the wireless router(for simplicity I plugged the computer into the wireless router via CAT5). The routers are on different floors with CAT5 connecting the two. Question: Can I assign the computer plugged into the 10. wireless router a 192. address and communicate through the 10. to the 192.? I am assuming that two NICs in the one computer would help but it is a laptop. I guess I could get a PCMCIA card and a Dongle... Note: I know I could take the easy way and configure the wireless to assign 192. addresses rather than 10. but I'd like to figure out if and how to do this for the learning experiance. I hope I have explained this well enough. Thank You, Tony Tag: Windows Auditing Tag: 287390
  - 22
    - Changing computer name I changed a computer name that is part of a small network but it has corrupted some of the files and other users in the network cannot access to the shared files and folders in this computer, what did I do wrong? Tag: Windows Auditing Tag: 287387
  - 23
    - IP not released when coming out of standby When I put my laptop into Standby, the IP assigned by DHCP does not get released. When I next start up, there's usually a conflict with another machine on the network that has grabbed that IP while the laptop was in standby. Is there any way to tell XP to ALWAYS release the IP when the machine is put into standby or is it the NIC mgfr's responsibility to put that ability into the driver? Tag: Windows Auditing Tag: 287377
  - 24
    - Lost internet connection I unplugged one of the PC's on my home network from the router for a few days. Upon plugging it back in, I can't get an internet connection. Everything appears OK and it says it's connected to the network, but no internet. Any pointers/tips/suggestions appreciated. This particular PC did give me some problems when the network was 1st setup but had been working fine. Jim... Tag: Windows Auditing Tag: 287376
  - 25
    - alternate DNS server not querried Win XP SP2 clients, Win 2K3 SP1 server, AD, server provides DHCP. DHCP options set primary DNS = 192.168.1.10 (the Win2K3 server) and alternate DNS = 192.168.1.1 (gateway device). Clients do not ever use the alternate DNS server, even when the primary DNS server is down. When I "net stop dns" on the server, clients cannot resolve names - they do not query the alternate 192.168.1.1. I've verified this by watching network traffic. On the clients I can run nslookup interactively and set the server to 192.168.1.1 and it does resolve names. The problem is that the XP DNS resolver client never uses the alternate server. ipconfig /all from a client: Windows IP Configuration Host Name . . . . . . . . . . . . : system12 Primary Dns Suffix . . . . . . . : foo.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : foo.local foo.local Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : foo.local Description . . . . . . . . . . . : GVC-REALTEK Ethernet 10/100 PCI Adap ter Physical Address. . . . . . . . . : 00-C0-A8-8B-72-7A Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 192.168.1.112 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.10 DNS Servers . . . . . . . . . . . : 192.168.1.10 192.168.1.1 Lease Obtained. . . . . . . . . . : Wednesday, April 02, 2008 4:04:45 PM Lease Expires . . . . . . . . . . : Thursday, April 10, 2008 4:04:45 PM nslookup using alternate DNS server: C:\TEMP>nslookup www.msn.com 192.168.1.1 *** Can't find server name for address 192.168.1.1: Non-existent domain Server: UnKnown Address: 192.168.1.1 Non-authoritative answer: Name: us.port.msn.com.nsatc.net Address: 207.68.173.76 Aliases: www.msn.com Tag: Windows Auditing Tag: 287374

Any tools available to Audit a windows XP operating system? i-e
missing patches, mis configurations, access controls etc.

Top

Re: Windows Auditing by John

John
Mon Apr 14 13:14:09 PDT 2008

sean <maash.rajani@gmail.com> wrote in news:dbb5b644-d45b-45c0-816a-
fd85e685e1fe@d45g2000hsc.googlegroups.com:

> Any tools available to Audit a windows XP operating system? i-e
> missing patches, mis configurations, access controls etc.
>

Start -> Help and Support -> Search: "Audit"

HTH,
John

Top

Re: Windows Auditing by john

john
Wed Apr 16 04:39:05 PDT 2008

On Apr 15, 1:14 am, John Wunderlich <jwunderl...@lycos.com> wrote:
> sean <maash.raj...@gmail.com> wrote in news:dbb5b644-d45b-45c0-816a-
> fd85e685e...@d45g2000hsc.googlegroups.com:
>
> > Any tools available to Audit a windows XP operating system? i-e
> > missing patches, mis configurations, access controls etc.
>
> Start -> Help and Support -> Search: "Audit"
>
> HTH,
> John

try Secure Auditor. Its new but its good. Check it out.
http://www.download.com/Secure-Auditor/3000-2653-10826743.html?part=dl-SecureAud&subj=uo&tag=button

Top