comp. part of network and logoff user

hi all

os : WINXPPRO
firewall: sygate personal.
and part of a network..... at work.

i was logged off when i was away of my comp.when i come back i logon
and the firwall detect incoming traffic from inside the network .
my qustions are :
1- is my comp.safe when i logoff my account while the comp. conected to the network?
2- if we share foldrs , is possbl ppl to conect to my comp. when my account logged off?
3- in case i block traffic when i loggedoff is that better or stil the same?or i have to disconect
the network cable from the comp.?

thanks in advance.
coolcamel

Yea I think it is possible to access your computer when your logoff, I know that you can access share folders when your logged off. So I assume that you can acess the rest of the computer.

For example remote desktop works when the server computer is logged off.

Yea I think both are similar but unpluggins always going to be safer. I think setting your computer up so that nothing can connect when your logged off is better for convience sake. Not sure how you set that up though

i2c

hi i2c

so its not safe.

i will disconect the network cable from the computer next time i logoff.

thanks 4 time.

May i be so free to ad a thing or two

Can you shut down the pc instead of yanking the network cable out?

Anyway no your pc is not safe when you log of. Shared stuff is still acceseble and you can stil
log in remotly. It is however not less secure then when you are logged in normaly.

Things like firewalls keep running in the background when you log of so if you have one and it's
properly setup you don't have that much of a problem.

May I ask why you asked this question, I'm yust wondering.

hi moonwolf

yes, i can shute down my comp instead of disconnect the network cable .
shut down its not good suoltion.
instaed of all that i think its better disabling the Local Area network connection in the task bar .

why i post this ?

i post it when i check the firewall log.whichs detect incoming traffic from the network while am logedoff.i used to check the firewall from time 2 time .

thanks moonwolf.

coolcamel

Coolcamel,
Unplugging your network cable or disabling your connection is not really the right way to go. Forgive me if I misunderstand but you said you are on a computer at work. I know that many network admins (me for example :) ) dont take kindly to people simply unplugging from the network. If you have concerns about the security of your work LAN try talking to the IT support people. It is their job to make sure your you have a secure work enviroment. If you have doubts about some of the traffic either post a log here or ask your network admin to take a look at it. It is quite normal that there is network traffic while you are not logged on to your computer. The other people in your office are logged on and they will generate traffic regardless.
If you were on your home computer i would recommend disonnecting form the network. In a work enviroment it may cause more security problems for the whole network than any thing else. If your computers antivirus is updated by a central server ,for example, outside of normal working hours the fact you have disabled your network connections while you are not logged on would mean that you would not have an upto date antivirus on your computer.
Also disabling your network card might stop you from logging back on to your computer if you account is stored on a domain.

If it's your personal (private) laptop and you've hooked it up to the companies network, if you did that in my shop I would kick you so fast out of the building it would make your head spin. Check with your admin if you're allowed to attach non-company owned equipment to their network.

If it's the companies laptop and you installed your own software, again I would kick you out because you've just compomised the TCB (Trusted Computing Base).

If it's non of the above and the admin installed the software check with him/her about the correct configuration.

If the admin does his/her work right you would see a regular scan of the netwerk. This is the admin looking to see if everything is working right.

whilst in the main I agree with peoples opinions above... instead of switching off or yanking the cable (NOT a good plan trust me) try sending the computer to sleep/hibernate after you log off. It should power down the ethernet card and stop sharing from happening - though the computer could be woken up by a LAN alarm you should be able to turn that off in the BIOS.

Z

PS don't need to add my opinions about if this your PC or companies etc SirDice has been fairly explicit ;)

PPS why is it not a good solution for you to turn off the computer??? seems sensible if you ask me

hi MURACU and SirDice ;)

well am at work using a desktop.
why I unplugging the network cable or disabling the connection? coz i want to be close to the comp. and keep my eyes on the firewall log.
and I have concerns about the security of my work lan and my data base shard foldr.

>netbios enabeld.
>every one can check his emal and use im applcation.
>every one can bring his personal stuff on floopy or other storge dvice .
>not all of the ppl keep the AV up to date.
is not all that above make me concern about security of the work lan and my files?

suppose this happen: afriend in work chatting with person in a puplic place in a netcafe,using one of the IM App and some how get the ip of that comp of my friend at work . what going to happen then ?

that was an example and they are know each other ,they are friends and the guy in the netcafe think its funny and all waht he is going doing is kinda of jok.

First thing come to my mind with netbioes enabeld when i check the firewall log when i was logedoff some 1 cracking my comp. using nbtstat command.

when i unplugging the netowrk i lost the connection,when i plug it again i get the connection .
when disable the LAN i lost the connetion ,double click the shourt cut of it i get the connetion back .

Zonewalker,coz its slow in starting.

thanks to u all .

coolcamel

if your connect to a network your going to get network traffic. computers are constantly communicating with each other. i think you'll find most or the traffic is comming from your domain controler, checking your status, seeing whos there and whos not. i mean even when the office is closed computer are still generating network traffic.

your firewall no doubt is set to see the network your on as a trusted domain and allows local traffic. anyone with admin privelages can kill the fiewwall process but ive gotta ask...what kind of place do you work for that you fear people breaking into your computer.

Quote:

---

If it's your personal (private) laptop and you've hooked it up to............................................................ and you installed your own software, again I would kick you out because you've just compomised the TCB (Trusted Computing Base).

---

gotta agree with you there - have enough probs making sure that work computers are clean without someone linking up their own PC with god knows what on it *shudders*

if your worried about people accessing your computer while you are gone why not just disable shares before you log off?

surely the only people who can remote desktop into your PC are the admin/tech guys and why worry about them messing up your PC? they're the ones who would have to fix it :)

as for just disconnecting cable I would go nuts at anyone in the office who modifies the hardware in any way at all without me telling them to do it. You may know what your doing but what about others in the office who may not anything about computers? if they follow your example and start yanking out cables who pays for any damages?

v_Ln

Coolcamel
The way it sounds you dont have much of an IT support team in your work place. If that is the case I can understand your concerns. The only thing is that the machine is not any safer when you are loged on or when you are not loged on. Unless of course you are spending all your time keeping an eye on your logs and know what exactly you need to look for.
If each person is responsable for the security of their workstation then i would sugest you do a serch here to find out how to properly secure you machine. I am sure that there are a good few threads dealing with the issue.
A few basic ideas :

keep your antivirus up to date.

Make sure you have strong passwords on your user account and if possiable on the local administrator account on the machine. That is if it is not defined by the network admin. If there is one thing that really annoys me it is to find, just when you are in the middle of an important update, someone changed the administrator password on a machine and deleted the domain admin from the local administrators group to make it more secure.

Keep up to date on the security patches from microsoft windows update, Norton live update, etc.

Anyway just a few ideas to get you started. The best weapon against any threat is knowledge, so keep informed.

All I can suggest is having a talk with the IT manager and tell him about your worries regarding the security at your company. You'll probably need to cut through loads of red tape but in the long run, and if you play your cards right, you'll make the whole company's network safer (and not just your machine) and you may even end up as the company's IT Security Officer.

hi all
thanks to you all ppl for your suggests
and your replies.

Quote:

---

All I can suggest is having a talk with the IT manager and tell him about your worries regarding the security at your company. You'll probably need to cut through loads of red tape but in the long run, and if you play your cards right, you'll make the whole company's network safer (and not just your machine) and you may even end up as the company's IT Security Officer.

---

SirDice I will took that as a motive and i will keep
reading and learing to become a computer Guru ;) .

thanks again .
coolcamel.

hi Zetaphor

Remot desktop is disabled from services.

Quote:

---

edit] Just occurred to me, have to authorize remote user to control comp, rather than just view

---

NO, i havnt authorize remote user to control comp.only netbios share.

Quote:

---

So there I was logging in, and emailing all my important files to some unknown source, and then deleting core system components, all on my office computer, while relaxing in the break room. God, gates is a genuios

---

in that case i will disconnct the cable from the computer till i i using it again.

regarding the bios i will tell the friend when am away .
if theay say NO i seem i have no choice its the hard way then its my computer.

Coolcamel
to disactive remote desktop you right click on the mycomputer icon go to properties and then click on the tab remote control. you just disactivate the two options for remote assistance and remote desktop. As far as I know the person using remote desktop needs to enter his user name and pass word before he can connect to your machine.
If someone wants to reactive the remote desktop when he doesn't have physical acces to the machine he will have to have access to the registry by the network. You can block this by going to the service manager and stopping the remote registry service. This also may not be appricated by the Admin but it is still better than pulling the plug on your network cable which is in my opinion the computer equivalent of sticking your head in the sand.

Another alternative is to lock down the connection when you want to "disconnect" from the network. Zone Alarm or Norton Firewall allows you to turn off network activity. You can do that and still be logged in and not physically disconnect.

If you disable netbios you can still survive on the corporate lan. You'll need to ip address of servers you need and log in to each individually.

hi

Lucktsm

Quote:

---

Another alternative is to lock down the connection when you want to "disconnect" from the network. Zone Alarm or Norton Firewall allows you to turn off network activity. You can do that and still be logged in and not physically disconnect.

---

ur takling about blocking all the traffice from the firewall .which is good alternative when am busy but not away of my computer.
by the way am using sygate firewall .
u know the admine of the network get sence of humour he told me once camel why dont u use norton on ur laptop?
i told him i dont have a latop .
he said " oh i forget,i seem am getting older i will start thinkig about retired "
i said " take it easy ".
poor admin thinks we all the same .

==
MURACU
i know how disable it but thanks for ur informtion .I will check them again as u know practicing and exercising leads u to be perfect.

thanks 4 u all
coolcamel