Guest / Helpassistant connection

[Wowbagger]

Is there any way to turn off the helpassistant connection that my machine is
showing? I have disabled the send/accept remote help requests but every
time I log on I still see the following in event viewer:

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 5/14/2003
Time: 11:35:54 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: desktop3
Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x400A6)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: workstation
Logon GUID: {00000000-0000-0000-0000-000000000000}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and the following entry from net user

Guest HelpAssistant

[Ajit Mohan [MSFT]]

Hi Wowbagger,

The Event ID : 540 indicates a succesfull login. Whenever you login the
associated builtin accounts are also logged in. The Helpassistant account
is one such account. Even if you disable the Remote assistance service the
account will still login. This is not a potential security violation as the
helpassistant account itself is disabled.

For further information on the remote assistance connection process you can
refer to Microsoft KB article at
http://support.microsoft.com/default.aspx?scid=kb;en-us;300692

Regards
Ajit
Microsoft
This posting is provided "AS IS" with no warranties, and confers no rights.
Get Secure! - www.microsoft.com/security



--------------------
| From: "Wowbagger" <none>
| Subject: Guest / Helpassistant connection
| Date: Wed, 14 May 2003 12:16:59 -0400
| Lines: 31
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
| Message-ID: >
| Newsgroups: microsoft.public.windowsxp.security_admin
| NNTP-Posting-Host: 66.238.128.167
| Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTN GP11.phx.gbl
| Xref: cpmsftngxa06.phx.gbl microsoft.public.windowsxp.security_admin:58849
| X-Tomcat-NG: microsoft.public.windowsxp.security_admin
|
| Is there any way to turn off the helpassistant connection that my machine
is
| showing? I have disabled the send/accept remote help requests but every
| time I log on I still see the following in event viewer:
|
| Event Type: Success Audit
| Event Source: Security
| Event Category: Logon/Logoff
| Event ID: 540
| Date: 5/14/2003
| Time: 11:35:54 AM
| User: NT AUTHORITY\ANONYMOUS LOGON
| Computer: desktop3
| Description:
| Successful Network Logon:
| User Name:
| Domain:
| Logon ID: (0x0,0x400A6)
| Logon Type: 3
| Logon Process: NtLmSsp
| Authentication Package: NTLM
| Workstation Name: workstation
| Logon GUID: {00000000-0000-0000-0000-000000000000}
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
|
| and the following entry from net user
|
| Guest HelpAssistant
|
|
|