Hi Frank,
It looks like you are a Direct Feed customer. Please feel free to
contact Tenable's support group with this issue.
Having said that, if you have it working against Windows 2003, you may
have a password, configuration, firewall or something else wrong on the
XP side.
Everyone of the messages below is an 'unknown' user name which is likely
the result of a Nessus vulnerability scan.
Also, if the target system is XP and not XP Pro, remote logins are not
supported by Microsoft.
Ron Gula
Tenable Network Security
Vianzon, Frank wrote:
> We are trying to perform the "Windows Compliency Checks" (that is the
> only plugin that we are choosing), and while it works with Windows 2003,
> it does not work with Windows XP.
>
>
> I am not sure how to tackle this problem. Is it a configuration problem
> with Nessus? Is it a authentication issue with Windows XP since it
> seems that the protocol on Windows XP is
> MICROSOFT_AUTHENTICATIION_PACKAGE_V1_0 versus NTLM on Windows 2003? Do I
> simply need to put in the plugin? If so, which one's? I looked under
> the Windows plugins on nessus site, and I can't make head or tails of
> which ones that I need.
>
> Here is what I see in the Nessus Log
>
> [Mon Sep 10 15:58:37 2007][7146] scada_iccp_livedata_dos.nbin depends on
> scada_iccp_livedata_detect.nbin which could not be found
> [Mon Sep 10 15:58:37 2007][7146] scada_iccp_sisco_osi_dos.nbin depends
> on scada_iccp_sisco_osi_detect.nbin which could not be found
> [Mon Sep 10 15:58:37 2007][7146] scada_devicexplorer_opc_code_exec.nbin
> depends on scada_opc_detect.nbin which could not be found
> [Mon Sep 10 15:58:37 2007][7146] user vianzofr2 starts a new scan.
> Target(s) : host.domain.com, with max_hosts = 40 and max_checks = 5
>
> When I look at the security log on the target machine, I see
>
> 1535,Security,Security,AUDIT FAILURE,DEN022852-D,9/11/2007 12:08:16
> PM,529,SYSTEM\NT AUTHORITY,Logon Failure: Reason: Unknown user name
> or bad password User Name: nessus6151591082574842721467405995
> Domain: Logon Type: 3 Logon Process: NtLmSsp
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name:
> 1532,Security,Security,AUDIT FAILURE,DEN022852-D,9/11/2007 12:08:16
> PM,529,SYSTEM\NT AUTHORITY,Logon Failure: Reason: Unknown user name
> or bad password User Name: administrator Domain: Logon
> Type: 3 Logon Process: NtLmSsp Authentication Package:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name:
> 1529,Security,Security,AUDIT SUCCESS,DEN022852-D,9/11/2007 12:08:16
> PM,540,ANONYMOUS LOGON\NT AUTHORITY,Successful Network Logon: User
> Name: Domain: Logon ID: (0x0,0x1B4B7D) Logon Type: 3
> Logon Process: NtLmSsp Authentication Package: NTLM Workstation
> Name: Logon GUID: {00000000-0000-0000-0000-000000000000}
> 1513,Security,Security,AUDIT FAILURE,DEN022852-D,9/11/2007 11:43:44
> AM,529,SYSTEM\NT AUTHORITY,Logon Failure: Reason: Unknown user name
> or bad password User Name: nessus118240213415242915942136033517
> Domain: Logon Type: 3 Logon Process: NtLmSsp
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name:
> 1511,Security,Security,AUDIT FAILURE,DEN022852-D,9/11/2007 11:43:44
> AM,529,SYSTEM\NT AUTHORITY,Logon Failure: Reason: Unknown user name
> or bad password User Name: administrator Domain: Logon
> Type: 3 Logon Process: NtLmSsp Authentication Package:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name:
> 1499,Security,Security,AUDIT FAILURE,DEN022852-D,9/11/2007 11:41:53
> AM,529,SYSTEM\NT AUTHORITY,Logon Failure: Reason: Unknown user name
> or bad password User Name: nessus13559986491828364271391789509
> Domain: Logon Type: 3 Logon Process: NtLmSsp
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name:
> 1497,Security,Security,AUDIT FAILURE,DEN022852-D,9/11/2007 11:41:53
> AM,529,SYSTEM\NT AUTHORITY,Logon Failure: Reason: Unknown user name
> or bad password User Name: administrator Domain: Logon
> Type: 3 Logon Process: NtLmSsp Authentication Package:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name:
>
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Nessus mailing list
> [email protected]
> http://mail.nessus.org/mailman/listinfo/nessus
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
