Event Viewer

[Guest]

Archived from groups: microsoft.public.windowsnt.print (More info?)

We are in 2003 Domain. We have NT 4 server (standalone) as
a print server and it's also part of the 2003 domain. Why
does the Event Viewer->System display some XP users as
Guest and User1 when they print. I want to know who
printed.

For some XP users, they displayed them appropriately as
their login user/profile & workstation? I checked their
groups and permission in Active Directory Users and
Computers they have similar setting.

Any advice on where to check?

Thanks

hugh

 

[Guest]

Archived from groups: microsoft.public.windowsnt.print (More info?)

This posting is provided "AS IS" with no warranties, and confers no rights

Hi Hugh,

To my knowledge , when there is a shared resource (folder or a printer) on
a standalone NT machine with guest account enabled.
Then any user from a different machine not logged on to the domain trying
to access it , will log in as a Guest auto mattically . Thats why
microsoft recommends you to
disable the Guest account and also everyone read access to ur shared
resources. THATS WHY GUEST IS LOGGED IN EVENT VIEWER !!

See the link below which confirms the above and see the summary below :

Goto The Guest Account Section :
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://www.microsoft.com/technet/prodtechnol/winntas/evaluate/featfunc/04wnt
pcb.mspx

Summary : -
============

Caution: The Guest account can inadvertently provide access to the default
shares on a computer. When you install a new Windows NT system, the network
drives are shared by default so they can be accessed from other systems. If
a user attempts to log on to a computer and the attempt fails, Windows NT
tries to use the Guest account to access the shares. If the Guest account
doesn't have a password, the user is connected to the shared drive
automatically.

If the guest acc is disabled then the NT machine will try to validate the
network user with any one of the Local User name and password
If user name and password are same on both machines then the user will be
automatically logged in or it will throw a LOG ON AS dialog box.
If the user provides the proper username and pwd of the destination machine
, then he can access all the shared resources according to the Permission
on the shared resource . THATS WHY USER1 IS LOGGED IN EVENT VIEWER !!

In case the domain authenticated user account is trying to access the
printer and he has permission then DOMAIN ACC IS LOGGED IN EVENT VIEWER !!

Hope i answered ur query !!

Regards,
Venkat.