Event Viewer Security shows Guest logon?

Event Viewer Security shows Guest logon?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Event Viewer Security shows Guest logon? Patrick Casher 05-11-2006
Posted by Patrick Casher on May 11, 2006, 8:54 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 5/11/2006
Time: 1:19:23 PM
User: MOMS\Guest
Computer: MOMS
Description:
User Logoff:
User Name: Guest
Domain: MOMS
Logon ID: (0x0,0x3FFDBD)
Logon Type: 3


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Having multiple entries as shown above. Is someone logging on my system as
guest? Running XP Home, DSL with wireless router. Thanks in advance,
Patrick.



Posted by Steven L Umbach on May 11, 2006, 9:46 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
It seems that someone accessed your computer via the network as logon type 3
is network logon. XP Home can only use simple file sharing where anyone
accessing the computer from the network accesses it as guest. If you have no
other computer on your network this would be cause for concern and I would
disable file and print sharing on that computer, enable the Windows
Firewall, and verify that your firewall protection is adequate. You can go
to one of the self scan sites such as http://scan.sygatetech.com/ to see
what holes they find in your firewall if any.

If you are using WEP for your wireless security you can also be vulnerable
because WEP is not secure by today's standards though it is better than no
wireless encryption which leaves your network wide open. If you have not
other choice change your WEP key frequently like at least once a week. WPA
is much better if your wireless router and adapter support it. Even with WPA
be sure to use a complex key of at least 12 characters. If someone accesses
your wireless network your computer is not protected by the wireless
router's firewall function that only protects it from untrusted networks
such as the internet. The Windows Firewall however could protect it from
such.

Of course make sure you check the computer for malware and spyware as it is
possible that a backdoor application is installed on the computer. Be sure
to use the latest definitions for whatever program you scan with by
downloading them from the vendors website. --- Steve

http://www.microsoft.com/athome/security/protect/windowsxpsp2/Default.mspx
-- Protect Your PC tips

> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 538
> Date: 5/11/2006
> Time: 1:19:23 PM
> User: MOMS\Guest
> Computer: MOMS
> Description:
> User Logoff:
> User Name: Guest
> Domain: MOMS
> Logon ID: (0x0,0x3FFDBD)
> Logon Type: 3
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Having multiple entries as shown above. Is someone logging on my system
> as guest? Running XP Home, DSL with wireless router. Thanks in advance,
> Patrick.
>



Posted by Roger Abell [MVP] on May 12, 2006, 4:43 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 538
> Date: 5/11/2006
> Time: 1:19:23 PM
> User: MOMS\Guest
> Computer: MOMS
> Description:
> User Logoff:
> User Name: Guest
> Domain: MOMS
> Logon ID: (0x0,0x3FFDBD)
> Logon Type: 3
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Having multiple entries as shown above. Is someone logging on my system
> as guest? Running XP Home, DSL with wireless router. Thanks in advance,
> Patrick.
Just to emphasize two things already mentioned by Steve . . .
To answer your question: yes.
Turn on your firewall, and if you have allowed any exceptions
use the scope capability on the exceptions to make sure only
the intended machines (i.e. IPs) are allowed.



Similar ThreadsPosted
Event ID 576/538 - Guest Logon October 27, 2007, 8:38 pm
Event Viewer : Security January 12, 2006, 11:52 am
Event Viewer - Security Log September 5, 2007, 6:54 pm
Event Viewer-Source:Security-ID540/538 October 18, 2007, 9:21 am
Event log shows NTLM not Kerberos August 24, 2006, 3:00 am
Event viewer July 29, 2007, 10:54 am
Locking down Event Viewer October 20, 2005, 10:28 am
Event viewer - access denied July 12, 2005, 3:58 pm
Internet Explorer in event viewer September 19, 2008, 5:30 am
remote access logons in Event Viewer July 28, 2005, 12:06 pm

The site map in XML format XML site map

Contact Us | Privacy Policy