Successive anonymous logons

From: BG (bg2_at_uasystem.ua.edu)
Date: 11/06/03


Date: Thu, 6 Nov 2003 10:32:27 -0600

At times I may have 30 or 40 successful Anonymous Logons or Logoffs within
virtually the same timeframe. The only thing that changes is the LogonID.
This occurs on a Win2K IIS 5.1 server. Web log files show activity at that
time from one authenticated user. What can be causing this and is it
suspicious activity?

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 538

Date: 11/6/2003

Time: 8:50:16 AM

User: NT AUTHORITY\ANONYMOUS LOGON

Computer: SERVER

Description:

User Logoff:

User Name: ANONYMOUS LOGON

Domain: NT AUTHORITY

Logon ID: (0x0,0x12F88DE5)

Logon Type: 3