IPSec Security Violation iTunes Desktop On Shutdown

Question

I could use some insight into why the iTunes desktop is causing a security violation when I shut the program down. I am receiving the following failure audit code in the Event Viewer/Security File:
Event ID 615
Error Message Received:
IP Sec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem.
IPSec Snap-in Statistics:
When I run the snap in I am not receiving any changes in values within the IPSec Statistics. All categories are reflecting “0”. Within the IKS Statistics the following two categories values have been changed to “1”, Active Acquire and Acquire Heap Size. I am allowing an exception to occur within my firewall for iTunes.
This problem is only occurring when I shut the program down and the error message is appearing randomly in the event viwer. Any help would be greatly appreciated in helping me understand why this is occurring.
OS: Windows XP Home SP2 Toshiba 1135/S155 Laptop

Answer 1

B Noir
After my last discussion with you on this subject matter I continued receive the 615-error code in my Event Viewer\Security folder. This really ticked me off my friend. All along I thought iTunes was the source of the problem. But this just was not the case. Before I present to you the actual problem I will say by changing the Target Scope on the firewall it did resolve some minor issues that I was having with iTunes. My apologies for any misunderstandings that may have taken place on this issue. Therefore, let me present the following information to you to settle this issue once and for all:
Event Viewer – Failure Audit Id 615 Description – Security Folder
Source: Security
Category: Policy Change
Failure Aud Event Id: 615
User: NT AUTHORITY\NETWORK SERVICE
Computer: OWNER-(For security reasons I have removed the rest of this information)
Description:
IPSec. Services: IPSec Services failed to get the complete list of Network Interfaces on the machine. This can be a potential security hazard to the machine since some of the interfaces may not get the protection as desired by the applied IPSec. Filters. Please run IPSec. Monitor to further diagnose the problem.
Notes:
This event discussion will apply to the following modem:
2Wire 1700HW
SN: 384114124206
Assembly Number: 4200-00174-000
When this event occurred no special filters were in place. All settings were set to “Default” system wide. Snap-in Monitor: IKE Statistics were in normal range. IPSec. Statistics values did not change indicating any problems.
I was determined to find out what was causing the problem. So, since the 615 entries were identified as a security issue I contacted MS Security Department as my starting point. After an hour of discussion with the security team and ruling out the possibilities it was not security related. So, they shot me over to the Windows XP Home SP2 support team. After ruling out any Windows based problems we determined that it was a Modem\port issue that was causing the problem.
Now that I had a starting to point to work with my final investigation produced the final solution to correct the problem.
When the event occurred I was receiving the entry’s randomly on start-up\reboot. After several hours of discussions and running tests with a BellSouth tech, I tracked the problem down to my Troubleshooting – Event Log in the 2Wire MDC\Management and Diagnostic Console. A BellSouth Tech Supervisor confirmed this problem once I identified the possible source.
Source of the problem: “Bad Modem\Port Issue” on link up. The modem is not connecting properly on link-up with the server. As a result I began having lost connection entries indicating that the service was restarting itself on the lost connection. To confirm my lost connection findings I installed a Server Monitor and set the monitor to “Poll” the server in one-minute intervals. The source of the actual problem in this case will be centered on the following connection process: “vlanmon0”. I have provided a copy of the link-up process tree for your review.
Final Summary: At times I was receiving a lot of lost connection entries in the MDC event log. This is what was causing the 615 entries to occur in the event log on my machine. You will not automatically receive a 615 entry in the Event Viewer\Security folder on lost connections. Again in this case I was only receiving the entries on start-up\reboot randomly.
What was more frustrating is when the events started to occur I went to my command prompt and pinged the IP’s within the routing table I kept coming back with 100% Success back to the server. Bottlenecking at the Socket Connection was also ruled out. I spent a total of five hours over a two-day period diagnosing the problem. I even allowed the tech to do a remote access session on my machine. In the end I had nothing but kudos’ on how well my machine was set-up and protected. Final conclusion: BellSouth will be replacing the modem.
615 error codes can be very difficult to resolve. In closing my discussion with you on this issue I would advise caution in resolving this issue due to the many variables involved with IPSec Services.
Thank you for the intelligent discussion on the issue.
2WIRE MDC - Link Tree
Management and Diagnostic Console
Advanced – Link Manager States
root
|-->homenet0 is up
||-->vlan0 is up
||\-->ipv4net1 is up
|| |-->vlanmon0 is up >>>>>>>(Source of Event Id 615 in Security Folder)
|| \-->ipv4bridge2 is up
|\-->vlan3 is up
\-->broadband0 is up
\-->adsl0 is up
Snap Shot of today’s lost connection: 2Wire Troubleshooting – Event Log
Type Date/Time Event Description
INF +000 days 00:00:00 SYS: System started
INF 2003/01/15 05:00:01 EST SYS: Set system clock from: 1969/12/31 19:00:00 EST
INF 2003/01/15 05:00:03 EST SYS: ipv4net1: Up on vlan0 with 192.168.1.254/24
INF 2003/01/15 05:00:24 EST SYS: ppp0: Up with ipv4 service on pppoe0
INF 2003/01/15 05:00:24 EST SYS: ipv4net0: Up on ppp0 with 72.155.108.75/32
INF 2006/09/05 07:02:42 EDT SYS: Set system clock from: 2003/01/15 05:00:25 EST
INF 2006/09/05 08:44:56 EDT SYS: Successfully logged into a password protected page
INF 2006/09/05 16:48:19 EDT SYS: Successfully logged into a password protected page
INF 2006/09/05 20:18:35 EDT SYS: vlanmon0: connection lost, reconnecting...
INF 2006/09/06 06:20:08 EDT SYS: Successfully logged into a password protected page
INF 2006/09/06 06:21:25 EDT SYS: Successfully logged into a password protected page
INF 2006/09/06 09:50:24 EDT SYS: Successfully logged into a password protected page
Jblittlejohn
OS: Toshiba Satellite 1135’S155 Windows XP SP2
Server: BellSouth – DSL Lite
Socket Connection: LPT2T1