Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i found this in my event log not sure if im

the source seems potentially dangerous

The service control manager (SCM) is started at system boot. It is a remote procedure call (RPC) server, so that service configuration and service control programs can manipulate services on remote machines.

i looked in the security event log and i cant find any correlation with the login id

            1201 - Time                     : 11/19/2012 11:02:52 PM
            1202 - Source                   : Service Control Manager
            1203 - Description              : An account was logged off.

                                              Subject:
                                                Security ID:        S-1-5-7
                                                Account Name:       ANONYMOUS LOGON
                                                Account Domain:     NT AUTHORITY
                                                Logon ID:       0x13e82ef

                                              Logon Type:           3
share|improve this question
add comment

1 Answer

The "Source" is what's reporting the event to the event log, not necessarily the cause.

S-1-5-7 is the security ID of an "Anonymous" user, not the Event ID.

Based on the Logon Type (3), it looks like (allowed) anonymous access to a network resource on your computer (like a shared folder, printer, etc.). So no-one is hacking, they are simply using a resource that is allowed to be used by users without logging on with a username/password (AKA: Anonymous).

Find the matching Logon event (probably Event ID 4624) and it's details should tell you where they're logging on from (IP address).

More info on Logon types here.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.