should joneq be worried?????

Reply

  #1  
Old 12-24-05, 09:21 AM
J
Member
Thread Starter
Join Date: Sep 2003
Location: NYC
Posts: 1,615
Received 0 Votes on 0 Posts
should joneq be worried?????

Just checked the security log in the event viewer and saw a lot of failures on startup. The ones that disturb me are #627.[many failures]. Is failure good?


Event Type: Failure Audit
Event Source: Security
Event Category: Account Management
Event ID: 627
Date: 12/24/2005
Time: 8:53:29 AM
User: Description:
Change Password Attempt:
Target Account Name: ASPNET
Target Domain:
Target Account ID: Caller User Name: Caller Domain: Caller Logon ID: (0x0,0x13907)
Privileges:



These were all failures and upon rebooting all were successful----but for who is the question?

There are no errors in the system or application depts.Except for the truevector error from Zone alarm. I do not have the .net framework installed if that matters. Thanks.

PS: I did do a lot of spyware deletion with MS,Adaware,spybot[all mostly tracking cookies ccleaner was also run along with A2. Virus scan detected nothing.
 

Last edited by joneq; 12-24-05 at 10:29 AM.
  #2  
Old 12-24-05, 08:53 PM
tae's Avatar
tae
tae is offline
Member
Join Date: Nov 2002
Posts: 2,467
Received 0 Votes on 0 Posts
627 is a password change. looks like some program or webpage using asp was trying to change the password. the target account name would be the account that tried to change the password. do you have an acount called aspnet?

627 A user password was changed.

Parameters: Name of target user account, domain of target user account, SID string of target user account, user name of subject changing the user account, domain name of subject changing the user account, logon ID string of subject changing the user account.

Configurable Information: Success

Formal name: SE_AUDITID_USER_PWD_CHANGED
 
  #3  
Old 12-24-05, 09:08 PM
J
Member
Thread Starter
Join Date: Sep 2003
Location: NYC
Posts: 1,615
Received 0 Votes on 0 Posts
No account by that name. I looked in the user accounts in the control panel and there is only me + admin[1 acct] and guest account[1 acct] that is turned off. I don't know if that was there before,but I think it was.
 
 

Thread Tools
Search this Thread
 
Ask a Question
Question Title:
Description:
Your question will be posted in: