Question about events in the event viewer on Xp machines.

[craiga1027]

We have a computer running Windows ME that registers an even on each Windows XP machine on our network each morning when the computer in question logs into the network. There is no reference to the computer logging on to our domain server.
The event on each XP machine is as follows.

Event

Date: 1/13/04 Source: Security
Time: 07:16:12 Category Logon/Logoff
Type: Success A Event ID: 540
Usser: Okagriculture\{username}
Compuer: {computer name}

Description
Successful Network Logon:
Username: {username}
Domain: {domain name}
Logon ID:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation: \\{computername}
Logon GUID:
This happens every morning when this computer logs onto the network.

Is there a virus that attempts to connect to all Windows XP machines or a known vulnerability. (all windows updates have been performed)

 

[bcastner]

See if a LAN management package is running on the machine, or a packet sniffer.

As far as I know the only vulnerability was in the original NT OS; that it poses no vulnerabilities for Win2k or XP.

 

[TechyMcSe2k]

This event indicates that a remote user has successfully connected from the network to a local resource on the workstation, generating a token for the network user. For example, mapping a drive to a network share or logging with an account whose profile has a drive mapping would generate this auditing message.

http://www.eventid.net/search.asp

is very helpful in searching Event ID's as well as

http://www.microsoft.com/technet/tr...chnol/windows2000serv/support/EE_win2ksvr.asp

Cliff, CCNA/MCSE/MCSA 2000
Network Administrator

 

[bcastner]

Techy69,

Yes, but...
This is not "standard" behavior.

 

[TechyMcSe2k]

It is probably the "ME" part after Windows on that machine

Cliff, CCNA/MCSE/MCSA 2000
Network Administrator

 

[bcastner]

I was wondering exactly that point.

Do you know if ME asserts this by default?

 

[TechyMcSe2k]

I do not have a lot of exposure on ME, but it is worth researching. I will let you know if I find anything.

Cliff, CCNA/MCSE/MCSA 2000
Network Administrator

 

[bcastner]

Thanks.

I will still hold to my belief that a third-party LAN management package, or a packet sniffer was installed until I hear from your or the original poster.

 

[craiga1027]

Thanks for all the info. I am check it out and see if there is any lan management software or packing sniffing software running.

**I am not real familar with windows me either, but we have several computers running me and there is only one with this unique problem.