Re: NT AUTORITY/ANONIMOYS LOGIN events in Event Viewer
From: Rajkumar Mohanram [MSFT] (rajkm_at_online.microsoft.com)
Date: 04/14/04
- Next message: Rajkumar Mohanram [MSFT]: "Re: sspi question"
- Previous message: John Burkhardt: "LsaRemoveAccountRights"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 13 Apr 2004 15:57:36 -0700
If you see an error message that indicates that the login has failed for NT
AUTHORITY\ANONYMOUS, this indicates that the identity on the Web server does
not have any network credentials and is attempting to access the remote
computer.
Identify which account is being used by the Web application for remote
resource access and confirm that it has network credentials. If the Web
application is impersonating, this requires either Kerberos delegation (with
suitably configured accounts) or Basic authentication at the Web server.
See
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetch13.asp
for more info.
-- Rajkumar Mohanram [MSFT] Windows Core Security This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm --------------------- "Gene" <gene_golub@hotmail.com> wrote in message news:261057CC-0AAB-428C-A351-3858062A5F1A@microsoft.com... > Folks > > I recently noticed plenty of login event records made by user from domain: > NT AUTORITY, user ANONIMOYS LOGIN in the Event Viewer. > I can not figure out whether it's legitimate system event or somebody > broke into my pc. I enabled all possible audits and all I see is a series > of login/logout events by above user which happen with interval of few > seconds within 10 - 20 min randomly. > > Does anybody have a clue what it could be? Thank you for your input.
- Next message: Rajkumar Mohanram [MSFT]: "Re: sspi question"
- Previous message: John Burkhardt: "LsaRemoveAccountRights"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
