Prev: where is registry file in the file system
Next: IIS7 and Active Directory
From: Dominick on 20 Apr 2010 08:40
I have been tracking down a security audit logon failure, and I found it
- here is what is going on. In Windows Server 2008 R2,

If I open Devices and Printers, right click on any of the Printers,
click Printer Properties, then click the Sharing tab, I get 2 logon
audit failures - one by explorer.exe trying to logon as Guest, and one
by printui.exe trying to logon as Guest. Guest account is disabled which
is why the audit failure occurs.

Also, if I bring up Windows Explorer and click around in folders, I will
get a logon security audit failure as well on the Guest account.

Why is this happening, why does Devices and printers and Windows
Explorer try to logon as Guest? BTW, this happens even if I am logged in
as a Domain Admin.

(BTW - system is AV/spyware free, I run HijackThis, spybot, and at least
one other).
From: Dominick on 20 Apr 2010 08:59
As a follow up, I have another Win2K8 R2 box that acts as DC, and it
does not use Guest to logon, so it gets no audit failures or audit
successes for logging on. I can't see what's different between the boxes
w.r.t. network settings, etc. All seems the same!

So why does this one box insist on logging in as Guest for Windows
Explorer and Devices and Printers/Sharing?

Thanks!

On 4/20/2010 8:40 AM, Dominick wrote:
> I have been tracking down a security audit logon failure, and I found it
> - here is what is going on. In Windows Server 2008 R2,
>
> If I open Devices and Printers, right click on any of the Printers,
> click Printer Properties, then click the Sharing tab, I get 2 logon
> audit failures - one by explorer.exe trying to logon as Guest, and one
> by printui.exe trying to logon as Guest. Guest account is disabled which
> is why the audit failure occurs.
>
> Also, if I bring up Windows Explorer and click around in folders, I will
> get a logon security audit failure as well on the Guest account.
>
> Why is this happening, why does Devices and printers and Windows
> Explorer try to logon as Guest? BTW, this happens even if I am logged in
> as a Domain Admin.
>
> (BTW - system is AV/spyware free, I run HijackThis, spybot, and at least
> one other).
From: Dominick on 20 Apr 2010 17:44
Does anyone have any ideas, can anyone help?

Thanks!

On 4/20/2010 8:59 AM, Dominick wrote:
> As a follow up, I have another Win2K8 R2 box that acts as DC, and it
> does not use Guest to logon, so it gets no audit failures or audit
> successes for logging on. I can't see what's different between the boxes
> w.r.t. network settings, etc. All seems the same!
>
> So why does this one box insist on logging in as Guest for Windows
> Explorer and Devices and Printers/Sharing?
>
> Thanks!
>
> On 4/20/2010 8:40 AM, Dominick wrote:
>> I have been tracking down a security audit logon failure, and I found it
>> - here is what is going on. In Windows Server 2008 R2,
>>
>> If I open Devices and Printers, right click on any of the Printers,
>> click Printer Properties, then click the Sharing tab, I get 2 logon
>> audit failures - one by explorer.exe trying to logon as Guest, and one
>> by printui.exe trying to logon as Guest. Guest account is disabled which
>> is why the audit failure occurs.
>>
>> Also, if I bring up Windows Explorer and click around in folders, I will
>> get a logon security audit failure as well on the Guest account.
>>
>> Why is this happening, why does Devices and printers and Windows
>> Explorer try to logon as Guest? BTW, this happens even if I am logged in
>> as a Domain Admin.
>>
>> (BTW - system is AV/spyware free, I run HijackThis, spybot, and at least
>> one other).
From: Dominick on 22 Apr 2010 06:43
Doesn't anyone have an idea on this? Surely someone knows something
about why Explorer is logging in as Guest?

On 4/20/2010 5:44 PM, Dominick wrote:
> Does anyone have any ideas, can anyone help?
>
> Thanks!
>
> On 4/20/2010 8:59 AM, Dominick wrote:
>> As a follow up, I have another Win2K8 R2 box that acts as DC, and it
>> does not use Guest to logon, so it gets no audit failures or audit
>> successes for logging on. I can't see what's different between the boxes
>> w.r.t. network settings, etc. All seems the same!
>>
>> So why does this one box insist on logging in as Guest for Windows
>> Explorer and Devices and Printers/Sharing?
>>
>> Thanks!
>>
>> On 4/20/2010 8:40 AM, Dominick wrote:
>>> I have been tracking down a security audit logon failure, and I found it
>>> - here is what is going on. In Windows Server 2008 R2,
>>>
>>> If I open Devices and Printers, right click on any of the Printers,
>>> click Printer Properties, then click the Sharing tab, I get 2 logon
>>> audit failures - one by explorer.exe trying to logon as Guest, and one
>>> by printui.exe trying to logon as Guest. Guest account is disabled which
>>> is why the audit failure occurs.
>>>
>>> Also, if I bring up Windows Explorer and click around in folders, I will
>>> get a logon security audit failure as well on the Guest account.
>>>
>>> Why is this happening, why does Devices and printers and Windows
>>> Explorer try to logon as Guest? BTW, this happens even if I am logged in
>>> as a Domain Admin.
>>>
>>> (BTW - system is AV/spyware free, I run HijackThis, spybot, and at least
>>> one other).
 | 
Pages: 1
Prev: where is registry file in the file system
Next: IIS7 and Active Directory