Why these errors in WinXP SP3?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

I have a WinXP PC in our small LAN that runs QuickBooks. The Office Manager has had problems with it and asked me to take a look. I continually find errors in the Security Log that might be related, but I don't have the experience to know where to go for resolution.

In anticipation of the question, detailed tracking for success & failure of processes is turned on in the Local Security Policy.

Can someone give me some ideas on what these mean and how to resolve them?

Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date: 7/30/2009
Time: 7:45:08 AM
User: NT AUTHORITY\SYSTEM
Computer: OFFICEMANAGER
Description:
The Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\WINDOWS\system32\lsass.exe
Process identifier: 812
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 1381
Allowed: No
User notified: No

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
============
Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date: 7/30/2009
Time: 7:45:09 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: OFFICEMANAGER
Description:
The Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\WINDOWS\system32\svchost.exe
Process identifier: 1204
User account: NETWORK SERVICE
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 59463
Allowed: No
User notified: No

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
============
I'm assuming that find the Process ID (1204) is the key for scvhost.exe, but where to go from here?

--
Mike Webb
Platte River Whooping Crane Maintenance Trust, Inc.
a conservation non-profit (501 (c)(3)) organization
Wood River, NE

.

Relevant Pages

  • Event ID 861
    ... I am getting a lot of events in the security log with ID 861: ... Event Type: Failure Audit ... Event Source: Security ... Event Category: Detailed Tracking ...
    (microsoft.public.windowsxp.general)
  • Event ID 861
    ... My Security Log is filling up with these: ... Event Type: Failure Audit ... Event Source: Security ... Event Category: Detailed Tracking ...
    (microsoft.public.windowsxp.general)
  • Re: Failure Audits in the secruity log Event Viewer
    ... I am on a stand alone machine, not a network, I have IPSEC Services ... Manages IP security policy and starts the ISAKMP/Oakley and the IP ... >> Event Type: Failure Audit ...
    (microsoft.public.windowsxp.security_admin)
  • MSDTC Security Log Failure Audits
    ... While scrolling through the Security logs of a Windows 2003 box, ... Event Type: Failure Audit ... Primary Logon ID: ... Client User Name: - ...
    (microsoft.public.windows.server.security)
  • Re: Help - RPC over http credential issue
    ... I am showing the following errors in my DC event security log: ... Event Type: Failure Audit ... Logon Failure: ...
    (microsoft.public.exchange.setup)