Successive anonymous logons

From: BG (bg2_at_uasystem.ua.edu)
Date: 11/06/03 

Date: Thu, 6 Nov 2003 10:32:27 -0600

At times I may have 30 or 40 successful Anonymous Logons or Logoffs within
virtually the same timeframe. The only thing that changes is the LogonID.
This occurs on a Win2K IIS 5.1 server. Web log files show activity at that
time from one authenticated user. What can be causing this and is it
suspicious activity?

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 538

Date: 11/6/2003

Time: 8:50:16 AM

User: NT AUTHORITY\ANONYMOUS LOGON

Computer: SERVER

Description:

User Logoff:

User Name: ANONYMOUS LOGON

Domain: NT AUTHORITY

Logon ID: (0x0,0x12F88DE5)

Logon Type: 3

Relevant Pages

  • Successive anonymous logons events in security log
    ... At times I may have 30 or 40 successful Anonymous Logons or Logoffs within ... User Name: ANONYMOUS LOGON ...
    (microsoft.public.inetserver.iis.security)
  • Successive Anonymous Logon events in security log
    ... At times I may have 30 or 40 successful Anonymous Logons or Logoffs within ... User Name: ANONYMOUS LOGON ...
    (microsoft.public.win2000.security)
  • Modify specific security settings in mmc.
    ... Another first :-))...I have searched Google, Microsoft support and also sent ... These Anonymous logons are identified with actual names as I see and here is ... "Successful Network Logon: ... One thing I saw when fiddling around in security settings and users right ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Modify specific security settings in mmc.
    ... > These Anonymous logons are identified with actual names as I see and here ... > Logon process: NtLmSsp ... > One thing I saw when fiddling around in security settings and users right ... > blank in that window by default. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Anonymous Login in the eventvwr
    ... Anonymous logons can be normal in a security log though if you are not using ... need to have file and print sharing enabled. ... I just recently set up a Windows 2003 Server Standart Editon. ... > Successful Network Logon: ...
    (microsoft.public.windows.server.security)