XP Home Edition Security log

[flutie1668]

Hi

I'm running XP Home Edition, and only have one user account equivalent as (Computer Administrator) and the Guest Account is turn off. However in my Event Log, security section there's more than 20+ sucessful logon/logoff information after boot up. And I check with my other computer which I have XP Professional Edition installed and the Event log is clean not even one single entry in security event log. So what exactly is wrong with my XP Home Edition, who is and what services need to logon/logoff during system boot up?? Please advice

[Murf]

Welcome to CTH

The security log records events such as valid and invalid logon attempts, as well as events related to resource use such as creating, opening, or deleting files or other objects. An administrator can specify what events are recorded in the security log. For example, if you have enabled logon auditing, attempts to log on to the system are recorded in the security log.

To set event logging options

1. Open Event Viewer

2. In the console tree, click the log you want to set options for.

3. On the Action menu, click Properties.

4. On the General tab, specify the options you want.

Note

• To open Event Viewer, click Start, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Event Viewer.
• You must be logged on as administrator or as a member of the Administrators group in order to complete this procedure.

• To restore the default settings, click Restore Defaults.
• To clear the log, click Clear Log.
• Under Log size, select one of these options:
• If you do not want to archive this log, select Overwrite events as needed.
• If you want to archive the log at scheduled intervals, select Overwrite events older than and specify the appropriate number of days. Be sure that the Maximum log size is large enough to accommodate the interval.
• If you must retain all the events in the log, select Do not overwrite events (clear log manually). This option requires that the log be cleared manually. When the maximum log size is reached, new events will be discarded.

[flutie1668]

Hi Murf

I do understand the event log is used to log all event during logon of a user. And I have try "Restore all Default" but what I don't understand is why there's so many entries in my security event log, and there's none in my XP Professional event log. I check both system setting and they are the same.

These are some of the entries in my event log

Special privileges assigned to new logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege



PSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem.


A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests.

Logon Process Name: Winlogon\MSGina



A port was listed as an exception when the Windows Firewall started.

Policy origin: Local Policy
Profile used: Standard
Interface: All interfaces
Name: NetBIOS Session Service
Port number: 139
Protocol: TCP
State: Disabled
Scope: Local subnet only