Jeff123df2

oh, ok. well thanks for the info. and thanks again for the advice too

good ideas! thanks thats what ill do. one more thing i forgot to ask.. is it possible to configure windows xp so that power users can install programs?

Hello, A friend of mine has an issue with the computer at her house. She is running windows xp professional and its the only computer at her house. She wanted to be able to change the system time, and install/remove any program on her system. I put a password of my own for her administrator acount so that i can access her computer as administrator to help her whenever she encounters problems with her computer. I created the user "Leslie" and made Leslie a member of the administrators group so that Leslie can install/remove programs as she requested. Sometimes the other people that live with her use her computer. Someone keeps changing the passwords for administrator and Leslie. We cant figure out who is doing it, and i want to prevent this from happening ever again. I tried removing her from the administrators group making her a power user instead. Then i set the ntfs permissions to allow power users 'modify' access to the entire hard drive. This doesnt solve the problem because she couldnt install programs anymore. Any advice would be greatly appreciated.

hi, i was wondering if anyone knew how to make it so that one administrator can't change or reset the password of another administrator in windows xp pro?

Thanks AskNetGuy. I got the netdom utility off the microsoft ftp site, as well as the resource kit update tools from the microsoft website. I gave it a shot and tried to run nltest but couldn't. I need the full windows nt resource kit to run it because there missing dll's. I went ahead and ran the netdom utility from the windows nt box. It reset the secure channel successfully. I tried to logon to the domain and it still wouldnt let me. I just remembered that i deleted the user account from the server that the windows nt box used to logon to the domain with. I deleted it and recreated it a while back. My mom told me something about if you delete the user account from the server, then your screwed and you'll never be able to make the connect again. I'm not exactly sure if this could be one of the causes as to why i still cant logon using any of the username from the domain anymore. Also, i may need to hit you up on that offer to borrow that resource kit. If you still think its worth running the nltest tool at this point. Thanks.

It obtains all the correct info via dhcp from the server perfectly. the server is also its dns server. I'm posting here right now using the windows nt workstation itself. So its seeing the internet and its also accessing shares on the domain controller perfectly fine. thats why this is all so weird. I've tried everything stated above except that netdom utility. Which seems to me like it would be the only way to fix the problem at this point. I went into active directly and deleted the computer from there also, then i joined a workgroup, rebooted, joined the domain (not logged onto it yet), didnt reboot, logged off locally and tried to logon to the domain and couldnt. Then i rebooted and tried again and couldnt logon. Of course everytime i rejoin the domain the computer is always back in active directory under "computers". I tried right clicking the computer in active directory and selecting "reset account". and then doing the same above steps on the local winnt workstation, didnt work. It still gives me the same message everytime. I've probably joined a workgroup and rejoined the domain about 10 times by now trying different things. There are no other subnets or sites here. We are all on the same subnet. There are other computers here which have had no problems with logging onto the domain. This computer used to logon to the domain perfectly fine. I think it all started maybe because there used to be a roaming profile that it was setup to use. I removed it because it wasn't needed anymore. After that, this workstation was used on a daily basis with a local user logged on locally. Then recently i tried to log onto the domain and got the error. I have never been able to logon to the domain again. Phew, I think i've said everything that i tried up to this point. I'm going to try to get my hands on this netdom utility and try that next. I hope this helps some more. If anyone can think of anymore possibilities please post. Thanks again to the people who have been reading this thread and especially those of you posting replies with ideas. Thank you very much.

I dont have domain admin privledges with the user that i was logged on locally with. I was logged on locally as administrator of the windows nt workstation box. but when i made the computer a member of the domain, i check the box at the bottom that say: "Create a user account in the domain. this option will create an account on the domain for this computer. You must specify a user account with the ability to add workstations to the domain above." i put administrator and the password for the domain administrator. (not the local one) then it said welcome to domain "Local" (the name of my domain) after i did that i rebooted and tried to logon to the domain local, and it still gives me that error message. Any ideas?

I followed the directions above by changing the windows nt workstation computer to workgroup. After i joined a workgroup I restarted the computer and logged on locally again. Then I re-joined the domain. I rebooted the computer once again and tried to logon to the domain. It gave me the same error message. I checked my event viewer and it has netlogon errors, event id 3210. Then I checked under system properties--->user profiles, I found a profile in there called "<account unknown>". I'm not sure if this could have anything to do with the problem. I deleted this profile and tried to logon to the domain but that didnt help. I'm still not sure how to go about solving the problem. Please help.

I have a windows nt workstation service pack 6 computer, and a windows 2000 server service pack 3 computer. We also have a domain setup with active directory. when the windows nt machine tries to logon to the domain i get the following error: The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect. I double checked the password on the server and confirmed that it is correct. I also went to the microsoft website and did some searching on this issue. I found a resolution to the problem here: http://support.microsoft.com/default.aspx?scid=KB;en-us;q175024 However, the resolution requires a netdom utility located on the Windows NT 4.0 Resource Kit Supplement 2. I dont have the netdom utility or the resource kit. I was wondering if anybody knew of an alternative solution to overcome this problem. Thanks in advance for your time.

i do have the latest virus defenitions. latest patches it is my router/nat ip which it see's. I purposely connected remotely using my (external address) so it see's the router/nat's internal ip. Any server you host will see this ip address because of this way that i connected to the server. no other machines running iis. also im not a target to anyone, just host the site on port 80 which makes me a target to viruses in that sense. my point in saying it is that there is no worries anymore because my workstation is secure (i know this for sure) and didnt that was nothing. Like i said probubly just the feature i checked in iis "index this resource" ill do a little more research though, uncheck that box and see if it ever happens again. Ill let you know what i find if you want. thanks for your advice

i just made another new discovery about this, im not as worried about this anymore: 2002-03-18 12:14:01 192.168.1.1 - 192.168.1.115 80 GET /<Rejected-By-UrlScan> ~/default.ida 404 192.168.1.1 is me, why would i try to infect myself. im guessing but, i think i might know what it is though, becuase i put the check box in the iis configuration "index this resource" maybe thats what it is and nothing at all to worry about.

Hi, i have another question im a little paranoid now after seeing this. i took your advice and installed iis lockdown, which now has url scan. i have a question about what im seeing here in a previous log file: 2002-03-10 11:47:00 61.174.224.203 - 192.168.1.115 80 GET /default.ida NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 200 - --this looks bad because now after installing urlscan and iislockdown i see: 2002-03-17 04:46:03 138.190.248.206 - 192.168.1.115 80 GET /<Rejected-By-UrlScan> ~/default.ida 404 - maybe this isn't a bad thing, what is default.ida? Is this bad that people were able to access it in the past?

I assume your talking about an ftp site for your iis server. is annonymous connections enabled? ill take a guess at this. Try making sure your "my shared folder" (which is root) has the proper permissions, he should at least have read access.

ahhh thanks again clutch

hello, im sorry to bother you again but something new just came up that i need help with. I was reviewing my iis logs, and seeing stuff like this: 2002-03-05 07:55:29 206.14.221.202 - 192.168.1.115 80 GET /scripts/root.exe /c+dir 404 - 2002-03-05 07:55:30 206.14.221.202 - 192.168.1.115 80 GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 - 2002-03-05 07:55:31 206.14.221.202 - 192.168.1.115 80 GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 - 2002-03-05 07:55:31 206.14.221.202 - 192.168.1.115 80 GET /msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe /c+dir 404 - 2002-03-05 07:55:31 206.14.221.202 - 192.168.1.115 80 GET /scripts/..Á../winnt/system32/cmd.exe /c+dir 404 - this just started happening. Is this bad? im not sure what exactly is going on in this log, could you help me out please? thanks in advance