Jump to content

Event ID 861


Recommended Posts

Guys i keep getting this ID showing on my Windows XP machine when logging onto my server with the newly released SP1:

Event Type: Failure Audit

Event Source: Security

Event Category: Detailed Tracking

Event ID: 861

Date: 05/04/2005

Time: 22:17:15

User: Kill-Bill\Quentin Tarantino

Computer: PulpFiction

Description:

The Windows Firewall has detected an application listening for incoming traffic.

Name: -

Path: C:\WINDOWS\system32\mstsc.exe

Process identifier: 4056

User account: Quentin Tarantino

User domain: Kill-Bill

Service: No

RPC server: No

IP version: IPv4

IP protocol: UDP

Port number: 1221

Allowed: No

User notified: No

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

that MS link is a waste of time as it never answers anything. I have configured Security Configuration Wizard to what i thought was right (unless you guys know why this occurs). I have also disabled the firewall on my server which only speeds up me connecting to the server (Ill get to that problem very soon)- Could you experts tell me whats going on here please and how to resolve? also i have done the following after reading this on MS website

Open Computer Configuration, open Administrative Templates, open Network, open Network Connections, open Windows Firewall, and then click Domain Profile and enabled "Allow local program exceptions" - that didnt do anything

Thx as always to you guys

Link to comment
Share on other sites


Thanks. Heres an odd one i turn off the firewall - same problem (turn off firewall on both server and client)

disable firewall on server only - same problem

disable firewall on client - problem resolved (this is with the firewall turned on the server)

so how am i suppose to configure the firewall on the client if the only way to resolve it is to disable the service?

thx

Link to comment
Share on other sites

Thanks. Heres an odd one i turn off the firewall - same problem (turn off firewall on both server and client)

disable firewall on server only - same problem 

disable firewall on client - problem resolved (this is with the firewall turned on the server)

so how am i suppose to configure the firewall on the client if the only way to resolve it is to disable the service?

thx

try configuring firewall using gpo

Link to comment
Share on other sites

ok i did that and have still some issues (same event id still logged in my client machine) ive set up the domain profile as in this picture - so what am i doing wrong? do i have enable something on the client machine?

thx

Well you need to enable the very first option, otherwise firewall is not working :) ... and don't forget to update your gpo, open cmd and type gpupdate /force on both the server and the client ...

Link to comment
Share on other sites

done that and i still have a few problems. So ill tell you one of them as i may be able to do the rest if i get this one right :angrym: :realmad: When connect using RDP to my server i have this event written in my client event log:

Event Type: Failure Audit

Event Source: Security

Event Category: Detailed Tracking

Event ID: 861

Date: 07/04/2005

Time: 17:11:46

User: Kill-Bill\Quentin Tarantino

Computer: PulpFiction

Description:

The Windows Firewall has detected an application listening for incoming traffic.

Name: -

Path: C:\WINDOWS\system32\mstsc.exe

Process identifier: 2584

User account: Quentin Tarantino

User domain: Kill-Bill

Service: No

RPC server: No

IP version: IPv4

IP protocol: UDP

Port number: 2149

Allowed: No

User notified: No

Now this as it says is caused by the FW so im assuming that i need to add C:\WINDOWS\system32\mstsc.exe to a safe list under these GPOs and my guess is Windows Firewall: Define Program Exceptions - so if i add C:\WINDOWS\system32\mstsc.exe to that GP shoudl it be put on both (client and server) and shoudl it be under the DOMAIN PROFILE only? or the Standard profile too?

Thanks

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...