Jeff123df2

Hello, A friend of mine has an issue with the computer at her house. She is running windows xp professional and its the only computer at her house. She wanted to be able to change the system time, and install/remove any program on her system. I put a password of my own for her administrator acount so that i can access her computer as administrator to help her whenever she encounters problems with her computer. I created the user "Leslie" and made Leslie a member of the administrators group so that Leslie can install/remove programs as she requested. Sometimes the other people that live with her use her computer. Someone keeps changing the passwords for administrator and Leslie. We cant figure out who is doing it, and i want to prevent this from happening ever again. I tried removing her from the administrators group making her a power user instead. Then i set the ntfs permissions to allow power users 'modify' access to the entire hard drive. This doesnt solve the problem because she couldnt install programs anymore. Any advice would be greatly appreciated.

oh, ok. well thanks for the info. and thanks again for the advice too

good ideas! thanks thats what ill do. one more thing i forgot to ask.. is it possible to configure windows xp so that power users can install programs?

hi, i was wondering if anyone knew how to make it so that one administrator can't change or reset the password of another administrator in windows xp pro?

I have a windows nt workstation service pack 6 computer, and a windows 2000 server service pack 3 computer. We also have a domain setup with active directory. when the windows nt machine tries to logon to the domain i get the following error: The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect. I double checked the password on the server and confirmed that it is correct. I also went to the microsoft website and did some searching on this issue. I found a resolution to the problem here: http://support.microsoft.com/default.aspx?scid=KB;en-us;q175024 However, the resolution requires a netdom utility located on the Windows NT 4.0 Resource Kit Supplement 2. I dont have the netdom utility or the resource kit. I was wondering if anybody knew of an alternative solution to overcome this problem. Thanks in advance for your time.

Thanks AskNetGuy. I got the netdom utility off the microsoft ftp site, as well as the resource kit update tools from the microsoft website. I gave it a shot and tried to run nltest but couldn't. I need the full windows nt resource kit to run it because there missing dll's. I went ahead and ran the netdom utility from the windows nt box. It reset the secure channel successfully. I tried to logon to the domain and it still wouldnt let me. I just remembered that i deleted the user account from the server that the windows nt box used to logon to the domain with. I deleted it and recreated it a while back. My mom told me something about if you delete the user account from the server, then your screwed and you'll never be able to make the connect again. I'm not exactly sure if this could be one of the causes as to why i still cant logon using any of the username from the domain anymore. Also, i may need to hit you up on that offer to borrow that resource kit. If you still think its worth running the nltest tool at this point. Thanks.

It obtains all the correct info via dhcp from the server perfectly. the server is also its dns server. I'm posting here right now using the windows nt workstation itself. So its seeing the internet and its also accessing shares on the domain controller perfectly fine. thats why this is all so weird. I've tried everything stated above except that netdom utility. Which seems to me like it would be the only way to fix the problem at this point. I went into active directly and deleted the computer from there also, then i joined a workgroup, rebooted, joined the domain (not logged onto it yet), didnt reboot, logged off locally and tried to logon to the domain and couldnt. Then i rebooted and tried again and couldnt logon. Of course everytime i rejoin the domain the computer is always back in active directory under "computers". I tried right clicking the computer in active directory and selecting "reset account". and then doing the same above steps on the local winnt workstation, didnt work. It still gives me the same message everytime. I've probably joined a workgroup and rejoined the domain about 10 times by now trying different things. There are no other subnets or sites here. We are all on the same subnet. There are other computers here which have had no problems with logging onto the domain. This computer used to logon to the domain perfectly fine. I think it all started maybe because there used to be a roaming profile that it was setup to use. I removed it because it wasn't needed anymore. After that, this workstation was used on a daily basis with a local user logged on locally. Then recently i tried to log onto the domain and got the error. I have never been able to logon to the domain again. Phew, I think i've said everything that i tried up to this point. I'm going to try to get my hands on this netdom utility and try that next. I hope this helps some more. If anyone can think of anymore possibilities please post. Thanks again to the people who have been reading this thread and especially those of you posting replies with ideas. Thank you very much.

I dont have domain admin privledges with the user that i was logged on locally with. I was logged on locally as administrator of the windows nt workstation box. but when i made the computer a member of the domain, i check the box at the bottom that say: "Create a user account in the domain. this option will create an account on the domain for this computer. You must specify a user account with the ability to add workstations to the domain above." i put administrator and the password for the domain administrator. (not the local one) then it said welcome to domain "Local" (the name of my domain) after i did that i rebooted and tried to logon to the domain local, and it still gives me that error message. Any ideas?

I followed the directions above by changing the windows nt workstation computer to workgroup. After i joined a workgroup I restarted the computer and logged on locally again. Then I re-joined the domain. I rebooted the computer once again and tried to logon to the domain. It gave me the same error message. I checked my event viewer and it has netlogon errors, event id 3210. Then I checked under system properties--->user profiles, I found a profile in there called "<account unknown>". I'm not sure if this could have anything to do with the problem. I deleted this profile and tried to logon to the domain but that didnt help. I'm still not sure how to go about solving the problem. Please help.

I was wondering if you could help me with my iis security. im running windows 2000 server (not as a domain controller) I created an account for my brother as a local user in computer management called "joe" Im running an ftp server and in the properties under the security accounts tab i unchecked "Allow Anonymous Connections" Inside my ftp home directory, i created a directory called "joe" so now when he logs in with username "joe" and his password, he is sent to the directory "joe" I noticed i was also able to login using my administrative account. is there a way to allow users to login to the ftp but not administrator remotely like this? also i was wondering is this bad practice for an iis ftp server?

i do have the latest virus defenitions. latest patches it is my router/nat ip which it see's. I purposely connected remotely using my (external address) so it see's the router/nat's internal ip. Any server you host will see this ip address because of this way that i connected to the server. no other machines running iis. also im not a target to anyone, just host the site on port 80 which makes me a target to viruses in that sense. my point in saying it is that there is no worries anymore because my workstation is secure (i know this for sure) and didnt that was nothing. Like i said probubly just the feature i checked in iis "index this resource" ill do a little more research though, uncheck that box and see if it ever happens again. Ill let you know what i find if you want. thanks for your advice

i just made another new discovery about this, im not as worried about this anymore: 2002-03-18 12:14:01 192.168.1.1 - 192.168.1.115 80 GET /<Rejected-By-UrlScan> ~/default.ida 404 192.168.1.1 is me, why would i try to infect myself. im guessing but, i think i might know what it is though, becuase i put the check box in the iis configuration "index this resource" maybe thats what it is and nothing at all to worry about.

Hi, i have another question im a little paranoid now after seeing this. i took your advice and installed iis lockdown, which now has url scan. i have a question about what im seeing here in a previous log file: 2002-03-10 11:47:00 61.174.224.203 - 192.168.1.115 80 GET /default.ida NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 200 - --this looks bad because now after installing urlscan and iislockdown i see: 2002-03-17 04:46:03 138.190.248.206 - 192.168.1.115 80 GET /<Rejected-By-UrlScan> ~/default.ida 404 - maybe this isn't a bad thing, what is default.ida? Is this bad that people were able to access it in the past?

I assume your talking about an ftp site for your iis server. is annonymous connections enabled? ill take a guess at this. Try making sure your "my shared folder" (which is root) has the proper permissions, he should at least have read access.

ahhh thanks again clutch

hello, im sorry to bother you again but something new just came up that i need help with. I was reviewing my iis logs, and seeing stuff like this: 2002-03-05 07:55:29 206.14.221.202 - 192.168.1.115 80 GET /scripts/root.exe /c+dir 404 - 2002-03-05 07:55:30 206.14.221.202 - 192.168.1.115 80 GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 - 2002-03-05 07:55:31 206.14.221.202 - 192.168.1.115 80 GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 - 2002-03-05 07:55:31 206.14.221.202 - 192.168.1.115 80 GET /msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe /c+dir 404 - 2002-03-05 07:55:31 206.14.221.202 - 192.168.1.115 80 GET /scripts/..Á../winnt/system32/cmd.exe /c+dir 404 - this just started happening. Is this bad? im not sure what exactly is going on in this log, could you help me out please? thanks in advance

thanks clutch. i read that page and that answered it for me thanks

cool ya, your right at the bottom of the page for the link you gave me, it said: "WARNING. Password sent to the FTP service are sent in absolute cleartext. SSL can't be used and you can't use NTFS authentication. No good solution exists for this problem using native Microsoft FTP server. " I'm worried about security in doing this. I have the same setup that they explained on that page. Would it be possible for someone to compromise my administrative password by having this type of setup?

go into the pdc's bois and check to see if the time/date is correctly set there

it has an ipsec passthrough and pptp passthrough feature in it. I'm going to accompany a friend of mine on a job to set up a vpn, and im thinking to myself, why not use the linksys router. Anyone out there ever use it with vpn? If yes, how has your experience been doing it with a linksys router? good? bad? interesting? let me know

ya i like icq its a better program in my opinion then msn messenger. i also got it to work through the linksys with aim by right clicking the nickname and clicking connect to send im about httport no luck, the program is meant for proxies. Although im happy with the router now because people seem to be writing their programs better for this type of situation. Like icq

trying to get this app to work. I've been asking them on their message board for help but unfortunately they dont have a good forum like this one (kind of dead) Ill let you know how it goes, but so far no luck with direct connect and linksys

I'll have to search for this program or one similar, it sounds like what i need.

i dont have money for anything of that sort. In fact i use a Linksys cable/dsl router and it has been great protection for me. Overall i honestly do like this router. (more so now than i did before, after ready your replys). The only that i can possibly have against the router, is the issue establishing direct connections using many programs, and even to a select few web servers i've had a problem. The way i've fixed it was by temporarily plugging my modem directly into the back of the workstation i was using to connect. Do people have this same problem when behind cisco routers? if not, just out of curiousity, why not?

not even if an internal machine is infected with a backdoor worm?