(1265) the system detected a possible attempt to compromise security

Are you running a firewall? Windows is not that clever...

Check your event logs (Start->Run->EVENTVWR.MSC) and see if there's anything resembling this error or its cause there...

I'm suspecting some obscure bug with SMB signing / DNS / DHCP ?
What's your DHCP lease anyways ?  

have you done online virus scan??

cheers

can you still ping the server when the transfer goes wierd?

It looks like it was Windows 2000 Server license problem.
Thanks anyway :-)

Pardon me being a bit thick - but what is the answer to this problem?  I have EXACTLY the same problem and am looking for an answer.

yes - I think that too.

What sort of licence problem?
I cannot find anything wrong.

Well Povilas is WRONG!  Thinking you have the answer is not enough! - the problem is actually caused by setting the XP Client to obtain it's DNS server address automatically.  If you SPECIFY the DNS server's i/p address, it works fine.  You give the "Alternate DNS Server" address as your ISP's primary DNS, so that you can still browse the Internet.

Apparently it is because that automatic mode is really for workgroups where there is no specific Domain Name Server and the workstations share the responsibility (but this is incompatible with a domain where you have a specific server providing DNS service.

well, I am afraid but I think you are wrong, cause the settings on XP client are set on manual...
by the way - it doesn't matter any more...

i just had the same error message and the same inability to get to my servers. after seeing the post about dns settings i remembered that this morning when the university's dhcp server went down, i had to apply my ip info manually in order to work. our subnet is 255.255.252.0, i discovered i had put 254.0. I could ping the server, but not access the mapped drives {(1265) the system detected a possible attempt to compromise security}, no net view, no nothing. i corrected the subnet mask and the error message went away and i could acces the mapped drives without even rebooting.

Dear "Povilas",
Since changing the setting on the XP client PC to a specific DNS address, instead of finding the DNS automatically, the client PC has remained connected for several DAYS without a problem, compared to the few HOURS that it used to manage before.  So clearly it has worked for me.  I would advise anyone else experiencing this problem (and I know from other discussion groups that there are lots) to change the TCP I/P properties to specify the I/P address of the DNS server followed by the DNS of your ISP instead of letting XP find it automatically.
PeterM

I am getting the exact same error message, however this machine is using static IP assignment and already had DNS servers manually assigned. Subnet mask is assigned correctly and there are no licensing issues on the Win2K server. My issue didn't occur every 5-10 hours, but more like 12 to 36 hours (although occassionally it does happen more frequently). I have also tried changing to enable netbios over TCP/IP and to disable TCP/IP.

One thing to note, dynamic updates to DNS were turned on (I had previously disabled this) so this might make sense as to why manually specifying DNS servers worked for some, if they chose a server that allowed updates (my DNS servers do not).

I was able to find an entry in the event log--not at the time the error occured, but I believe between when I was last able to access and when I couldn't. The error pertains to problems with auto-enrollment.

"Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b).  The specified domain either does not exist or could not be contacted.
  Enrollment will not be performed."

Here is a link to a soluton for that:
http://support.microsoft.com/default.aspx?scid=kb;en-us;310461&sd=ee

I have now turned off auto-enrollment (gee, the first error occurred during the time my win2k server was backing up so it seems pretty fishy). I will let you know if this solves my issues.

-
Susan

The issue is caused by the client trying to resolve a server IP with a DNS server outside the internal network.

Example: DNS Server 1 is 192.168.0.2 (192.168.0. being your internal subnet) and DNS Server 2 being 199.44.2.10 (Sprint's Central Florida DNS Sever). The client is occasionally trying to go out to 199.44.2.10 to resolve the IP address for your internal server.

Set your client to explicitly check your internal network DNS server, or if you are using DHCP- set it that it is only listing internal DNS servers. If neither of those are viable options, the set up a LMHOSTS file on each cliently specifically pointing to your internal authentication server.

It looks like the answer is in the DNS settings. I logged on to EE today to check the exact same error ... "The system detected a possibel attempt to comprimise security" and I tried the suggestion of checking the DNS settings and sure enough my LAN connection was set to automatically retrieve DNS settings from DHCP server ... which is my router ... I changed this to a primary DNS of my domain server and secondary DNS of my router (DHCP server) ... everything is fine now .... EE saves the day again.

Thank You All,
-Rich

I am adding to this thread because of a couple of reasons.... First, I purchased a subscription to this forum community specifically because I cannot find a legit answer to my problem, and I am at the point where I am submitting multiple questions in different forums.

I am having the "compromising security" problem listed above with a Windows 2003 Server, and Windows XP Pro clients. I have all of the computers configured with a static IP address, which means that there is no DHCP requests happening. Everywhere I have looked on the net talks about the DNS DHCP requests that are causing this error. In my specific case I have ruled out the DNS problem, unless... it is possible that I have the DNS server on the Win2003 server configured wrong... Any suggestions?

Thank you,

Brian Weiss

itech-sol

The problem is specifically related to misconfigured DNS settings. On your network if you are using Active Directory you need to assign your Domain Server (IP Address) as the DNS server for all of your Win XP clients ... this more than likely will fix the problem. DHCP is not the same as DNS and DNS is ALWAYS required if your are using TCP/IP at all to access the Internet or an Active Directory .... so check your settings.

rkvincent,

Thank you. The problem definately has to do with adding the server's IP address to the DNS entry on the workstations. This has helped me quite a bit.

Thanks again.

Sorry to bring up such an old thread but what if the PC is a laptop and this happens when the user is trying to access a shared drive via a VPN connection from the outside ?

tasupport, you're going to have to configure your VPN client/server to use Internal DNS through the tunnel instead of the ISP the remote laptop is connected to. Look through your VPN's documentation or post another topic.

Good luck.

its DNS error... I've put the wrong DNS thats why i got this error

just had this error, i entered my servers dns manually and it fixed the fault.

I just experienced this error and the cause was rather prosaic; the user had gone past his allowed logon hours. I adjusted these and the problem disappeared...

yep dns problem for mee too , i moved the xp machine to another physical network and in the new network it got its dns off the router , this messed with the active directory / dns domain integration , i set the primary DNS server to be my Domain Controller and the secondary to be the router on that remote network and now the error is gone after log off / log on.
Thanks...

Had the same problem. Remembered I had changed my DNS to my ADSL router address (usually run off internal DNS - but for some reason can't access facebook that way - don't care that much about FB to resolve the problem so just change the DNS on the few occassions I need to access it) - changed it back to my internal DNS and bingo problem went away.

the in cmd type
net use and see if it disconnected.