Event 861
 

Dear all,

I find a lot of message for even 861 in my PC's Security Event Log. I know
our company GPO have logging on success and failure event on process
tracking. Is it someone wrong with my firewall setting. I use tasklist /svc
and find the Process ID 1660 is dnscache. Is it normal? Usually what, is the
recommendation for Detail Tracking for Corporate client?

Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date: 25-02-2010
Time: 12:14:39 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: xxx
Description:
The Windows Firewall has detected an application listening for incoming
traffic.

Name: -
Path: C:\WINDOWS\system32\svchost.exe
Process identifier: 1660
User account: NETWORK SERVICE
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 64253
Allowed: No
User notified: No

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Regards,
TC