Another USER might be logged on?

My newly built home LAN consists of 3 PCs [2 are wireless].LAN uses an
old LINKSYS WRT51AB router with WEP enabled. All 3 PCs use WIN XP PRO.
I am not sure I have security totally correct yet.

Question:
Occasionally, when the wired desktop is turned off, XP often asks at
shutdown, "Other USERS might be logged on, do you really want to
shutdown and risk them, loosing data"?
Not sure of exact message.

Always when I am asked this question, the other two wireless PCs have
been OFF all day. Is it possible that another USER [not part of my LAN]
is really logged on? If yes, that USER must have logged on using
WIRELESS. How can I see that USER to identify him? Since the desktop
does not have any wireless NIC card or wireless on MOBO, must I turn on
a wireless PC to find POSSIBLE OTHER WIRELESS USER?
Is this info in the router logs? Is there software that will help me ID
the unwanted USER? How can I determine if there is REALLY a unwanted
USER? IS XP sending me a message that is not a real problem?

Dave_S

"Dave_s" <group78@dslextreme.com> wrote in message
news:13i1vbsq7qbfo5f@corp.supernews.com...
> My newly built home LAN consists of 3 PCs [2 are wireless].LAN uses an old
> LINKSYS WRT51AB router with WEP enabled. All 3 PCs use WIN XP PRO.
> I am not sure I have security totally correct yet.
>
> Question:
> Occasionally, when the wired desktop is turned off, XP often asks at
> shutdown, "Other USERS might be logged on, do you really want to shutdown
> and risk them, loosing data"?
> Not sure of exact message.
>
> Always when I am asked this question, the other two wireless PCs have been
> OFF all day. Is it possible that another USER [not part of my LAN] is
> really logged on? If yes, that USER must have logged on using WIRELESS.
> How can I see that USER to identify him? Since the desktop does not have
> any wireless NIC card or wireless on MOBO, must I turn on a wireless PC to
> find POSSIBLE OTHER WIRELESS USER?
> Is this info in the router logs? Is there software that will help me ID
> the unwanted USER? How can I determine if there is REALLY a unwanted USER?
> IS XP sending me a message that is not a real problem?
>
> Dave_S

access the router (192.168.1.1 or similar) and look for something like
Status or DHCP table which will list comps logged on.............look at
Host names or IP addresses. Might pay to know your own first.

Dave_s <group78@dslextreme.com> hath wroth:

>Question:
>Occasionally, when the wired desktop is turned off, XP often asks at
>shutdown, "Other USERS might be logged on, do you really want to
>shutdown and risk them, loosing data"?
>Not sure of exact message.

That means you have file sharing enabled on this PC and that some
other machine has initiated a NETBIOS connection. All the other
machine needs to do is open a folder or open then close a file, and
you'll get that message. I usually just ignore it unless I'm doing
some remote admin or editing.

You can get a clue as to which machine is connecting with:
nbtstat -S
<http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/nbtstat.mspx?mfr=true>

Microsoft also hid one of their network bug fixes under "User Profile
Hive Cleanup", which is basically fixes the mess that W2K and XP leave
behind when shutting down the computer. It have very little to do
with users, profiles, hives, or cleanup. It really speeds up reboots
and shutdowns in that Windoze networking doesn't have to wait to
disconnect already closed sessions.
<http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en>
I install this on literally all my customers W2K and XP boxes.


--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

"Dave_s" <group78@dslextreme.com> wrote in message
news:13i3n80rjdnck76@corp.supernews.com...
> Kris wrote:
>> Dave_s writes:
>>> Question:
>>> Occasionally, when the wired desktop is turned off, XP often asks at
>>> shutdown, "Other USERS might be logged on, do you really want to
>>> shutdown and risk them, loosing data"?
>>> Not sure of exact message.
>>>
>>> Always when I am asked this question, the other two wireless PCs have
>>> been OFF all day. Is it possible that another USER [not part of my LAN]
>>> is really logged on?
>> [...]
>>
>> Next time you get the message, close all your Internet-using apps and
>> use TCPView to see what programs have open connections.
>> http://www.microsoft.com/technet/sys...s/TcpView.mspx
>>
>> If you don't share files between PCs, you can "unbind" file sharing from
>> the network/wireless interface.
>> http://sis.berkeley.edu/SIS/sis-trai...le-sharing.htm
>>
>> You say you are using WEP. WEP is just "encoding" (this alleged
>> "encryption" is now basically as effective as ROT13) and you must change
>> to WPA immediately with a non-dictionary or multi-word passphrase.
>
> I understand the limitations of WEP. My very old router only allows WEP. I
> must buy another router to use WPA.
>
> Two of the PCs on LAN are laptops with small hard disks.
> The third PC is a desktop with large hard disk. As I install [new] WIN XP
> PRO on a laptop, I download files through LAN from the desktop's large
> drive. I think that is file sharing. Would not be easy to move files
> between PCs via LAN without file sharing. If I understand, I cannot stop
> file sharing through the LAN. I may be confused, please comment.

in place of WPA -
use MAC filtering to restrict wireless access to only those systems you have
defined their Ethernet (MAC) hardware address.

If you print from the WiFi laptops via the wired machine or in other ways
touch it remotely - it will potentially show up as having other "users".