How can I trace the IP address of the machine source "remote shutdown"?

Hello

I have Activate Shutdown event log in my XP machine, however again, I'm not able to trace the IP on 15 XP workgroup computer that stop away from my machine.

Is the command that could have been used: stop, f, r, m- t: 0

Can anyone suggest me how to trace this IP of the remote machine?

Or at least tell me what protocol or port shutdown.exe uses when it sends the command remotely.

I captured ProcMon, Journal NetMon and wire-shark, yet, I have no idea to start my investigation.

Help, please.

Nothing of what you said is causing me to believe that a remote machine is responsible for - or - nothing to either exclude it.

Recommend that you disable the administrator account to see if the actions continue or don't use is no secpol.msc:

Local policies | Security options | Accounts: Administrator account status

.. .set to disabled.

You are welcome.

You can also rename the account using accounts: Rename administrator account

----------------------

In addition, you can go to local policies | The audit policy | Audit system events

and the two checkboxes for the success and failure

In this way, newspapers will be created with details about what you can see in the case where the Viewer. The Windows logs. Security

------------------------

In addition, if you check on the user rights assignment section, it is useful as things "Force shutdown from a remote system" - you can remove administrators from there.

Tags: Windows

Similar Questions

  • How can I program the machine of the time's up

    How can I program the machine of the time's up

    Time Machine is designed as an incremental backup system. It defeats the purpose it is only work one or two times a day, etc.

    If you want anyway, there are third-party solutions such as TimeMachineEditor and TimeMachineScheduler.

  • How can I change the definition of remote site without breaking all the links?

    I created a website and put it here http://home.Comcast.NET/~alpsf/index.html to test it during construction.  Now when I change the definition of remote site to the local site in DW, all the links are broken.  I suspect now that the problem is I did my site root and ~alpsf/ DW inserted in all the links.  Is there a way to fix this?

    Thank you very much.

    You can do a search and replace to change the links in the world. Make sure you do a full backup of the site before doing this incase you do not correctly. Let me stress what still once, backup your entire site incase you need to restore. If you have created a "new site" and it will not part of the / ~ alpsf site, then you will need to define a new site and copy all the files in this folder (I'm guessing that this is the case). I copy the files outside Dreamweaver. You could do this without touching the files in the ~ alpsf directory. There are many variable here because I don't know exactly what you are doing.

    On the file menu select window/results-select search. (This is done if the search engine is not open).

    Find: all of the current Local Site

    Search: Source Code

    Search: "/ ~alpsf/".

    Replace: ' / '.

    That should do it, but it is a very delicate thing. I wouldn't have a problem doing this as long as I backed everything up.

    Jim

    Published: you will need to enter in your css, spry files and all others who has links to do the same (this time only select search in: current document when the document is open). Once this is done, delete the entire remote site and upload the changes once you check that everything is complete.

  • How can I trace the movements of the mouse and ignore the movements not

    I have a program that records the position of the mouse each 300 ms over a period of approximately 9 hour minute.

    However, I need to know the mouse ONLY when it is not the same now previous position (sometimes the user stops talking. I don't want to save 5 minutes from the same position of the mouse)

    Here is the original program

    var drawTimer:Timer = new Timer (300, 500000);

    drawTimer.addEventListener (TimerEvent.TIMER, timeSampler);

    function timeSampler(evt:TimerEvent):void {}

    {trace (mouseX, ', ' + mouseY);

    }

    }

    I tried to create a variable to capture the position of the mouse at a specific time

    var posMouseX:Number = mouseX;

    var posMouseY:Number = mouseY;

    and to add a conditional statement in the function

    If ((mouseX! = posMouseX) & & (mouseY! = posMouseY))
    {trace (mouseX, ', ' + mouseY) ;}}

    but I do not do this correctly because I no more than getting every movement of the mouse or none

    Can anyone suggest a better way to do it?

    Thanks in advance

    The code above can do what you want

    you will get the values only when the mouse is moved, there will be no duplicate values

    stage.addEventListener (MouseEvent.MOUSE_MOVE, onMove);

    function onMove(e:MouseEvent):void

    {

    trace (mouseX + "," + mouseY);

    Add your code here to save the values, for example:

    myArray.push (mouseX, mouseY);

    }

    as the timer still counting down and on full it will delete the scene event listener.

    var drawTimer:Timer = new Timer (300, 500000);

    drawTimer.addEventListener (TimerEvent.TIMER_COMPLETE, timeSampler);

    function timeSampler(evt:TimerEvent):void

    {

    stage.removeEventListener (MouseEvent.MOUSE_MOVE, onMove);

    }

    drawTimer.start ();

  • How can I trace() the length of a table outside the onLoad()

    Hello evryone, I have a question that I need to get the length of an array, but outside the onLoad()

    Here is my code:

    var O:XML = new XML();
    O.ignoreWhite = true;
    O.onLoad = {function (success)}

    var photos: Array = this.firstChild.childNodes;
    _root. PanelH = photos.length * 200;
    trace (PanelH);
    };
    trace (PanelH);
    O.Load ("VideosBank.xml");

    I shure is possible, but I can't find

    If the table you're talking about is the photos, then for access from outside the function you have to declare it outside the function.

    var photos: Array;

    O.onLoad = {function (success)}

    pictures = this.firstChild.childNodes;
    _root. PanelH = photos.length * 200;
    trace (PanelH);
    };

    You will not be able to trace something of significant long until after the onLoad function has completed table however.

  • How can I get the html source code of beeing displayed page?

    In the previous version of Firefox (4) the view menu contained option 'page source '. In the current version (6) this option disapired.

    Oops! I have it! Been moved from Tools/Web Developer / Source Page.

    See you soon,.

    Peterat

  • How can I restart the Apple TV Remote (4th Gen)

    Hi all

    I have a relatively new Apple TV (4th Gen) and tonight after a few weeks of work perfectly, the remote control slide to the right and in other directions only intermittently. I read up before you call Apple and it seems to me that it is a new issue. Here my question is it possible to restart the remote where the little glitches occur. A poster suggested battery, it looks like there must be a pressure button to reset the remote control, if you know of one, please post. I'll try next, logout and re-pairing to see what is happening, and then from there head to the store tomorrow.

    Any ideas appreciated.

    So I solved the problem by restarting the Apple TV itself, and now the remote works again. Also amazing that my iPhone was working very well as a remote control before the reboot, so don't know why this Apple TV restarting fixed but there.

  • How do I ge the button 'Show remote content' in my incoming messages?

    How can I get the button 'Show remote content' in my incoming messages?

    Thank you.

    Tess

    Mailnews.message_display.disable_remote_image controls all remote content.
    I hope change permissions.default.image will make the button reappears.

    Note that the next version of Thunderbird should have a brand new remote content management system.

  • I changed my email address of my ID Apple online, but my iphone still ask again me for my old email password, which no longer exists, how can I change the email to my new on my iPhone

    I changed my email address of my ID Apple online, but my iphone still ask again me for my old email password, which no longer exists, how can I change the email to my new on my iPhone

    Go to settings | Mail, Contacts, calendars and change e-mail account information.

    T.

  • How can I remove the empty address book folders?

    Export and import of my collected folders and personal address, I first tried to export and import the folder "AddressBook" no address could be copied from high level, so it created new empty folders of collected and personal address on my new computer. Then I exported and imported the collected individual records and personal address from my old computer to my new computer which uses Windows 10.

    The problem is that my new computer has now two folders named collected addresses, a vacuum with a capital "A" address and another with a lower case 'a' address and two folders named personal address book, a vacuum with a great book 'B' and another which addresses has a tiny 'b' book in his name.

    I tried to delete empty folders by selecting a vacuum and by going to Edit | Book addresses to delete and left click on it, but nothing happens. The empty folder is not deleted. Perhaps thinking that they had protected the names, I tried to change the names of empty folders to different names, but failed to do so. (I change the name of a folder to group e-mail address).

    How can I delete the two folders to empty address book? If this is not possible, then how can it change their names 'Empty' to so I don't select them in the future? Thank you.

    have you tried dragging them

    or this add-om https://freeshell.de//~kaosmos/morecols-en.html

    The add-on provides an option to import and export native files of MAB. So, you can replace an address book with another. No export and import required.

    then go to your old install and locate the (PAB) abook.mab and History.mab (collected addresses) or use the add-on or close Thunderbird and replace the vacuum with a full tank.

  • How can I get the address bar does not redirect me?

    Since the recent update for Firefox 36.0.1, a URL typed on the address bar is now taking me to a website where I can buy this unused domain name (buydomains.com). This is not where I want to go. I have no intention to buy a domain name; I don't particularly appreciate receive advertising in response to my fault for typing. What I would like is a good, not old Error 404 to tell me that I looked for something that didn't exist. How can I prevent the address bar to send me off, in the arms of the advertiser, but get just a 404 instead of this message?

    Hello

    I have to fully understand and appreciate the magnificence of a 404 error. He immediately told you what you wanted to know - that the site is not found!

    What you see is where the registration and ownership of the site was passed to the registry which is owner of the domain. The site is located, it is just acting as an announcement of the person who is the owner of the URL so that they can sell or resell.

    The address bar works as it should - it displays the URL as requested - it's just not the preferred outcome. One way you can get around this is use a parental control addon and include the name of the registry in the watchlist (or edit list so that it is the only entrance). She stops at the page to display. (Link) is an example of the kind of addon, that you could use.

  • How can I get the address book to sort by the name of 'Family' (using v 31.3.0).

    After a computer crash, I had to load Thunderbird (v31.3.0) in my computer running Windows 8.1, and I managed to import my address book backup file in Thunderbird (v31.3.0).
    My problem is that I don't see an option to sort the address book by name of 'Family', which was available with the version of Thunderbird, I had before the crash.
    How can I get the address book to sort by the name of "family"?

    "Address book".
    Select address book
    "View' > 'Show name as' > last/first". "

    You can sort by name.
    Click on the 'Name' column header to change the sort order,
    Reversed, then click on the 'Name' column header again to reverse the order.

    Or
    'View' > ' sort by ' > select 'Name' and 'Crescent '.

  • I need to reinstall my Linux Mint, therfore also Thunderbird. How can I save the addresses and all my messages (copy and again after installation Thunderbird)

    I need to reinstall my Linux Mint 17 companion, therfore also Thunderbird. How can I save the addresses and all my messages (copy and again after Thunderbird installation)?

    You will need to backup your Thunderbird profile.
    _ http://KB.mozillazine.org/Thunderbird: _FAQs_:_Backing_Up_and_Restoring #Manually_back_up_the_profile

  • I imported my address books. How can I remove the default empty

    I imported my address from my old computer books in Thunderbird on my new computer. Empty default address books don't seem to be able to be deleted, so I have now two books personal address and two collected addresses, the first of all is the default value for empty one and the second is my populated version. Thunderbird seems to point to the default empty. How can I remove the empty for default Thunderbird to my places.

    Thank you

    I don't think you can remove the default books. I open any personal book, select a contact, do a control + a to select all and drag in the personal address book by default. Then delete the empty book. Then do the same for the collected books.

  • Why, in the address bar in the url no but "go to website"? How can I see the url in the address bar?

    Why the address bar is not URL, but the "go on the web site? How can I see the URL in the address bar?

    Here's a few addons that other users have reported to cause the same problem in the past: Gom player, Ask Toolbar, DivX Web Player, RealPlayer Plugin browser Record (more)...

    in case you have one of them is present, try to disable/remove it - otherwise you could disable all extensions of your & re-enable each (a browser restart may be required after each step) until find you the culprit.

Maybe you are looking for

  • Help HP 15 Notebook PC windows 8.1 with disk drive-

    I bought the computer listed above currently and I'm having a hard time trying to insert a disc into the disc drive, there is no button aren't I guess there should be

  • x 301 BIOS downgrade on non-Windows installation

    Hello I have updated the BIOS on my X 301 1, 02 - 1.02 to 1.05 - 3.10 and are experiencing a significant increase in power consumption 20-25% (estimate). I have updated with the hope that I would get a better battery life and the BIOS startup time, b

  • Aspire unlike the model S7-392

    Can someone tell me the difference between these two models? Aspire S7-392-7863 (NX. MBKAA.029)Aspire S7-392-9439 (NX. MBKAA.015) There is the only difference in the specs is supported memory card, they say "Secure Digital (SD) card" and the other "S

  • Media Player will not play music files now that he used to play.

    I have Windows Vista and my media player has recently decided that it will not play some music files that it used to play. When I try to read, I got the error message saying that the file type is not supported by the player, or that the file was comp

  • Can I get my computer to talk to me?

    Hello Several years ago, I saw a movie on TV, where a young kid almost started a war on his computer. The movie could have been called "war games." In any case when the child went to his computer and press a button, the computer said, ' Hello, Richar