Windows 10: Windows Logon type 2 captured by service accounts

Discus and support Windows Logon type 2 captured by service accounts in AntiVirus, Firewalls and System Security to solve the problem; Hi , We have build a use-case to alert us when there is a interactive login from service accounts in our network . Upon checking with the concerned... Discussion in 'AntiVirus, Firewalls and System Security' started by rahul1988, Nov 26, 2020.

  1. rahul1988 Win User

    Windows Logon type 2 captured by service accounts


    Hi ,


    We have build a use-case to alert us when there is a interactive login from service accounts in our network . Upon checking with the concerned team they mentioned they are not physically login into any system using those accounts .The events shows logon type 2 however . Can you please assist us what possible could be reason for capturing these logins under logon type 2 .


    As per you article

    A user can interactively logon to a computer in one of two ways:


    • Locally, when the user has direct physical access to the computer.


    • Remotely, through Terminal Services, in which case the logon is further qualified as remote interactive. Microsoft Terminal Server uses the CredSSP Protocol [MS-CSSP] to securely delegate the user's password or smart card PIN from the client to the server to remotely log on the user and to establish a Terminal Services session.

    :)
     
    rahul1988, Nov 26, 2020
    #1
  2. Vesao Win User

    Remove account

    I suggest you backup your personalized files first before removing the account.
    To delete an account, follow these steps:
    1. Press WIN + X keys and click Command Prompt (Admin) from the menu.
    2. Type the following command and press Enter. Replace test with the name of your sister's account. Code:
     
    Vesao, Nov 26, 2020
    #2
  3. FiiLeTe Win User
    Window 10 Auto-Logon (Hotmail/MS Account)

    Hello everyone!

    So, i've updated my PC to Windows 10 and i have a little problem.

    Anyone knows how to auto-logon without asking for password using Hotmail/MS Account? I i've already tried the trick using "netplwiz" from Windows 8 wich always worked totally, and in Win10 it just does not work, it keeps asking me for password...

    Anyone knows how to bypass this without having to create a local account?

    Cheers.
     
    FiiLeTe, Nov 26, 2020
    #3
  4. Windows Logon type 2 captured by service accounts

    Securing Windows 2000/XP/Server 2003 services HOW TO

    This is all i could save. I dont know if people can see what I can in the Wiki, but I got this article the others he deleted b4 he posted them in the wiki and i dont have the powers even in my sections to bring them back...perhaps a back up but Im not sure we have one ill go see. He did a damn good job at making sure nothing of his existed after he left...Im at school but when i get home ill email him and see if i can get him back im not done fighting yet.-Solaris17




    Securing Windows 2000/XP/Server 2003 services HOW TO
    I went at ALL of the services in Windows Server 2003 (some will not be in XP for instance, & Windows 2000 has no NETWORK SERVICE or LOCAL SERVICE as far as I know, but not sure, you can always make a limited privelege user too for this on 2000 if needed)...

    I did testing to see which services could be run/logged in as LOCAL SERVICE, or NETWORK SERVICE, rather than the default of LOCAL SYSTEM (which means Operating System entity level privileges - which CAN be "misused" by various spyware/malware/virus exploits).


    LOCAL SERVICE startable list (vs. LocalSystem Logon Default):


    --------------------------------------------------------------------------------

    Acronis Scheduler 2 Service
    Alerter (needs Workstation Service Running)
    COM+ System Application
    GHOST
    Indexing Service
    NVIDIA Display Driver Service
    Office Source Engine
    O&O Clever Cache
    Remote Registry
    Sandra Service
    Sandra Data Service
    SmartCard
    Tcp/IP NetBIOS Helper
    Telnet
    UserProfile Hive Cleanup Service
    Volume Shadowing Service
    Windows UserMode Drivers
    Windows Image Acquisition
    WinHTTP Proxy AutoDiscovery Service
    NETWORK SERVICE startable list (vs. LocalSystem Logon Default):


    --------------------------------------------------------------------------------

    ASP.NET State Service
    Application Layer Gateway
    Clipbook (needs Network DDE & Network DDE DSDM)
    Microsoft Shadow Copy Provider
    Executive Software Undelete
    DNS Client
    DHCP Client
    Error Reporting
    FileZilla Server
    Machine Debug Manager
    Merger
    NetMeeting Remote Desktop Sharing Service
    Network DDE
    Network DDE DSDM
    PDEngine (Raxco PerfectDisk)
    Performance Logs & Alerts
    RPC
    Remote Desktop Help Session Manager Service
    Remote Packet Capture Protocol v.0 (experimental MS service)
    Resultant Set of Policies Provider
    SAV Roam
    Symantec LiveUpdate
    Visual Studio 2005 Remote Debug
    PLEASE NOTE: Each service uses a BLANK password when reassigning their logon entity (when you change it from the default of LOCAL SYSTEM Account), because they use SID's as far as I know, not standard passwords.


    --------------------------------------------------------------------------------

    WHEN YOU TEST THIS, AFTER RESETTING THE LOGON USER ENTITY EACH SERVICE USES: Just run your system awhile, & if say, Norton Antivirus refuses to update, or run right? You KNOW you set it wrong... say, if one you test that I do NOT list won't run as LOCAL SERVICE? Try NETWORK SERVICE instead... if that fails? YOU ARE STUCK USING LOCAL SYSTEM!

    If you cannot operate properly while changing the security logon entity context of a service (should NOT happen w/ 3rd party services, & this article shows you which ones can be altered safely)?

    Boot to "Safe Mode", & reset that service's logon entity back to LOCAL SYSTEM again & accept it cannot do this security technique is all... it DOES happen!

    If that fails? There are commands in the "Recovery Console" (installed from your Windows installation CD as a bootup option while in Windows using this commandline -> D:\i386\winnt32.exe /cmdcons, where D is your CD-Rom driveletter (substitute in your dvd/cd driveletter for D of course)) of:

    ListSvc (shows services & drivers states of stopped or started)

    Enable (starts up a service &/or driver)

    Disable (stops a server &/or driver)

    Which can turn them back on if/when needed

    Last edited by APK on 03/04/2007
    I.E. -> I removed Telephony, Symantec AntiVirus, & Virtual Disk Service!

    (ON Virtual Disk Service being removed, specifically: This was done solely because, although it will run as LOCAL SERVICE, diskmgmt.msc will not be able to work! Even though the Logical Disk Manager service does not list VirtualDisk as a dependency, this occurs, so VirtualDisk service was pulled from BOTH the LOCAL SERVICE and NETWORK SERVICE lists here... apk)

    SECURING SERVICES @ THE ACL LEVEL VIA A SECURITY POLICY HOW-TO:

    STEP #1: CONFIGURE A CUSTOM Microsoft Management Console for this!

    Configuring yourself a "CUSTOM MMC.EXE (Microsoft Mgt. Console)" setup for security policy templates, here is how (these are NOT default Computer Mgt. tools, so you have to do this yourself, or run them by themselves, but this makes working w/ them convenient):

    ===============================================================
    The next part's per BelArcGuy of BELARC ADVISOR's advice (pun intended):
    ==============================================
    Anyone want to try a test CompletelyBonkers (new user here) turned me onto?

    ==============================================
    "Security Configuration and Analysis" is an MMC snap-in. To access the MMC, type in mmc to the Windows Run.. command to pop up the console. Then use it's File|Add/Remove Snap-in... command and click the Add button on the resulting dialog. Choose both "Security Configuration and Analysis" and "Security Templates", close that dialog, and OK. You'll end up with a management console that has both of those snap-ins enabled. The whole MMC mechanism is a bit weird, but does work"

    (It's easy, & it works, & is necessary for the actual steps to do this, below)


    --------------------------------------------------------------------------------

    (Next, is the actual "meat" of what we need to do, per Microsoft, to set ACLs)


    --------------------------------------------------------------------------------

    STEP #2: HOW TO: Define Security Templates By Using the Security Templates Snap-In in Windows Server 2003

    Define Security Templates By Using the Security Templates Snap-In - Windows Server

    Create and Define a New Security Template

    (To define a new security template, follow these steps)

    1. In the console tree, expand Security Templates. 2. Right-click %SystemRoot%\Security\Templates, and then click New Template. 3. In the Template name box, type a name for the new template.

    (If you want, you can type a description in the Description box, and then click OK)

    The new security template appears in the list of security templates. Note that the security settings for this template are not yet defined. When you expand the new security template in the console tree, expand each component of the template, and then double-click each security setting that is contained in that component, a status of Not Defined appears in the Computer Setting column.

    1. To define a System Services policy, follow these steps: a. Expand System Services. b. In the right pane, double-click the service that you want to configure. c. Specify the options that you want, and then click OK.

    ==============================================
    )
    APK (added 03/08/2007)
     
    Alec§taar, Nov 26, 2020
    #4
Thema:

Windows Logon type 2 captured by service accounts

Loading...
  1. Windows Logon type 2 captured by service accounts - Similar Threads - Logon type captured

  2. What credentials to use when a service requires logon account?

    in Windows 10 Gaming
    What credentials to use when a service requires logon account?: I am running Windows 11 Home. I created a Microsoft account instead of a local one when setting up my computer. My backup software runs as a service. It needs account credentials from me to run. When I try to use my email associated with my Microsoft account and my password,...
  3. What credentials to use when a service requires logon account?

    in Windows 10 Software and Apps
    What credentials to use when a service requires logon account?: I am running Windows 11 Home. I created a Microsoft account instead of a local one when setting up my computer. My backup software runs as a service. It needs account credentials from me to run. When I try to use my email associated with my Microsoft account and my password,...
  4. What is logon type 0?

    in Windows 10 Software and Apps
    What is logon type 0?: I was in the middle of playing a game on my gaming laptop and sudden the screen went black. Out of panic,, I just turnt off the laptop and turned it on a few minutes later. When I checked the event logs there was a login for logon type 0? I can’t find any information on what...
  5. What is logon type 0?

    in Windows 10 Drivers and Hardware
    What is logon type 0?: I was in the middle of playing a game on my gaming laptop and sudden the screen went black. Out of panic,, I just turnt off the laptop and turned it on a few minutes later. When I checked the event logs there was a login for logon type 0? I can’t find any information on what...
  6. What is logon type 0?

    in Windows 10 Gaming
    What is logon type 0?: I was in the middle of playing a game on my gaming laptop and sudden the screen went black. Out of panic,, I just turnt off the laptop and turned it on a few minutes later. When I checked the event logs there was a login for logon type 0? I can’t find any information on what...
  7. User profile service service failed the logon

    in Windows 10 Software and Apps
    User profile service service failed the logon: Recently my keyboard stopped working. Due to the fact that my laptop did not experience any physical damage, I reset my laptop in the hopes that it was a software problem. After resetting my laptop I have been unable to login to my laptop with it saying “user profile service...
  8. Client Service Logon Failure

    in Windows 10 Customization
    Client Service Logon Failure: I am having trouble getting a Client Service (SageTV) to logon. System: Windows 10, Java 8., I have tried to start it manually. I have verified the password on the account matches that which the service uses to logon. I have reset both several times to match. The...
  9. How to set a service to a specific logon account?

    in Windows 10 Installation and Upgrade
    How to set a service to a specific logon account?: Microsoft update service starts automatically. So I wanna set the service to a specific account. Windows version: 1709, build: 16299.547....
  10. TimeBroker Service Unable to Logon

    in Windows 10 Support
    TimeBroker Service Unable to Logon: Hello everyone, I have an issue that causes my computer to randomly freeze after a restart once logged in. The mouse is still usable but I'm not able to click on the start menu or open most apps. Also the task-bar just goes blank. The only way to counter this is do restart...