Student has placed a start up message on one PC

[speckytecky]

Just doing a check on an XP Pro PC and found that a student has placed a message that activates on start up. Clicking ok or trying to get rid of it by Alt F4 etc has no effect, I can move it round the screen but after a while it pings back into the middle again.

 

 

[Arcath]

if its affecting only that PC then it must be in C:\Documents and Settings\All Users\Start Menu\Startup If its not visible in there then run msconfig and go to the startup tab, that will list everything that runs on login.

[cbeeching]

Least it's not a rude message

[Guest TheLibrarian]

If you can't find it with msconfig try Autoruns for Windows, that should find it.

[tech_guy]

The little jerk probably saw this on YouTube:

 

[speckytecky]

Thanks for that Arcath,

 

Tried that but nothing visible.

 

Strangely the message is pre log on - it's sitting there as soon as you switch the PC on covering the Cntrl Alt Del box o

[JJonas]

search registry for 'happy days'

 

does turning off the messaging service get rid of it?

[clareq]

It looks as if they have run a net send command from another machine - does it reappear on reboot?

[jamesreedersmith]

boot the machine off the network and see it its still there - if it is its local and if its not its a remote job.

[Ex-MGSTech]

Also try, admin tools/local security policy/local policies/security options/

Interactive logon:message title for users attempting to log on and Message Text for users attempting to logon

 

 

This can also be accessed by Tweak UI run from a pen drive

[Gatt]

That looks suspiciously like a winpopup/NET SEND message... chances are high that it was sent multiple times,. hence why you get it multiple times...

Checkyour services for the "Messenger" service - if its enabled then all somone needs to do is use either winpop or type "net send computername your message here" or "net send usename your message here"

 

more info here - http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/net_send.mspx?mfr=true

[speckytecky]

Thanks - it looks like you are on the money Clareq.

 

Not there on a reboot.

 

Any idea how I can trace where it came from and block it - I have an idea which PC it was because the moron put his name on the message!!

 

XP pro PCs on Server 2008 network.

 

 

It looks as if they have run a net send command from another machine - does it reappear on reboot?

[Guest TheLibrarian]

It looks as if they have run a net send command from another machine - does it reappear on reboot?

 

I assumed that it was a dialog box dressed up like a net send message because it kept jumping back to the centre of the screen, but I guess multiple messages would have explained that.

[ricki]

Hi

 

Have a look in the event viewer and see what you can see. You can also switch on your logging options to include the "process

tracking" and possibly "object access"

 

Have a look at this Windows & Active Directory Auditing

 

I think its the windows messenger service that you have to disable but I am not sure. Have a look here How to prevent Windows Messenger from running on a Windows XP-based computer

 

 

Then you can see who called the process.

 

Richard

[Michael]

The thing that's strange is the Messenger service has been disabled (by default) since XP SP2 or later. I think in Vista/Windows 7 it was removed completely.

 

I'd recommend you manually stop and disable the Messenger service on the local machine, then do the same on the network via GPO so you can be sure it cannot be switched back on.

[speckytecky]

Where do I find this in Group Policy (Server 2008) please - I'm currently looking in Student Settings / Computer Config / /// Windows Settings / Security Settings / System Services but no sign of it there?

 

You can override the Messenger service in Group Policy. You do need to have it enabled for things like Print Manager Plus.

[tarquel]

Just checked myself on a Windows 2008 server.... open Group Policy Management Editor and if you create / edit a GPO (at some domain based level that will affect all computer objects), you should find it:

 

Computer Configuration > Policies > Windows Settings > Security Settings > System Services

 

and its just called Messenger

 

Tick the "Define this policy setting" and choose Disabled

 

and edit the security if you like too, to something like SYSTEM: Full Control, Domain Administrators: Start,stop and pause and INTERACTIVE:Read

 

 

See if that does the trick.

 

Nath

[speckytecky]

Thanks tarquel.

 

OK been and followed your offering all OK through to >System Services but Messenger isn't listed here - strange or what? Windows Server 2008 Standard SP2 running 32 bit.

 

Just checked myself on a Windows 2008 server.... open Group Policy Management Editor and if you create / edit a GPO (at some domain based level that will affect all computer objects), you should find it:

 

Computer Configuration > Policies > Windows Settings > Security Settings > System Services

 

and its just called Messenger

 

Tick the "Define this policy setting" and choose Disabled

 

and edit the security if you like too, to something like SYSTEM: Full Control, Domain Administrators: Start,stop and pause and INTERACTIVE:Read

 

 

See if that does the trick.

 

Nath

[tarquel]

It is a default / clean / non-edited source DVD of Server 2008 when you installed that server correct?

[burgemaster]

It is a default / clean / non-edited source DVD of Server 2008 when you installed that server correct?

 

lol, only a fool would install anything else on their servers!!!

[speckytecky]

Yes certainly was!

 

It is a default / clean / non-edited source DVD of Server 2008 when you installed that server correct?

[tarquel]

lol, only a fool would install anything else on their servers!!!

 

Hehe but worth a ask