Unexpected Secutity Event id 540

From: Borgert (borgert@uct.nl)
Date: 05/07/02 

From: "Borgert" <borgert@uct.nl>
Date: Tue, 7 May 2002 03:48:46 -0700

Hello,

I've installed recently ISS and Citrix NFuse on a Win2k
Pro Server with Citrix MF XP. There runs an active website
on it.
Now I get security-event logs (see below). Nobody worked
at that moment on the server but nevertheless there was
someone or somewhat logging in. Three times that night for
about 20 minutes. Only at security events I got a log, not
at system or applicationevents.

My question is wether this is a systemcheck or an
internetsurfer. The possibility of the last thing
frightens me of course.
The accredentials seems to be correct, there are no
warnings in the eventviewer such as failured login
attempts.

Who can tell me something usefull about this?

thanks in advance,
borgert@uct.nl

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 30-04-02
Time: 3:33:35
User: SERVERNAME
Computer: SERVERNAME
Description:
Successful Network Logon:
         User Name: IUSR_SERVERNAME
         Domain: SERVERNAME
         Logon ID: (0x0,0x214A5A0)
         Logon Type: 3
         Logon Process: IIS
         Authentication Package:
        MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
         Workstation Name: SERVERNAME

Quantcast