General discussion

Locked

Possible Attack?

By d.jones092 ·
Howdy All.

Got a strange problem with one of my Win2k Pro SP4 machines. Basically, what I'm seeing is that the NetLogon and ComputerBrowser services are totally missing on this computer. They do not appear in the Services area. Whenever anyone but the local admin or the daily user tries to sign in they get a message saying that NetLogon is not started. However, because it's not in the list, we can't start it. I have tried to start it from the command line, however, I get back that the service name is invalid.

We have made a change in our environment in the past few days. We had a Netware 4.2 server in the mix, which was our primary data server. We migrated the data to a Win2k server and turned the Netware off. The machine in question still had the Client Service for Netware installed. However, as of this morning it has been uninstalled.

We're running Symantec Anti-Virus Client in our environment. However, I can't say for sure if it was installed on this machine. It is not present, however I can't imagine myself or the other person in the department would deploy the machine without this installed.

Any thoughts?

This conversation is currently closed to new comments.

7 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by pierrejamme In reply to Possible Attack?

Do you have a Domain? Has this computer been joined to it? How do you supply IP Numbers? DHCP, Router or Static? does it have an IP number? Start run CMD IPconfig /renew.

If it previously connected through NetWare client, the Microsoft client may be missing. Go to Network in control panel and right click on "Local Area Connection" and select properties. is "Client for Microsoft Networks" and "Internet Protocol (TCP/IP)" installed? If missing just click ADD.
Server is??
Need more info??

Collapse -

by d.jones092 In reply to

Poster rated this answer.

Collapse -

by sgt_shultz In reply to Possible Attack?

anything in event log on machine in question. post eventid, source and description. while you are waiting for us to look it up for you, have a crack at looking it up for yourself at support.microsoft.com
i would shotgun this by removing and reinstalling all my network components what clients are installed? install microsoft client for windows networks

Collapse -

by d.jones092 In reply to

Poster rated this answer.

Collapse -

by CG IT In reply to Possible Attack?

check your W2K/2003 DC system event logs and file replication logs for sysvol folder problems.

if you've removed a DC or added a DC into your network, replication might prevent the sysvol folder from being shared out.

Collapse -

by d.jones092 In reply to

Poster rated this answer.

Collapse -

by d.jones092 In reply to Possible Attack?

This question was closed by the author

Back to Security Forum
7 total posts (Page 1 of 1)  

Related Discussions

Related Forums