Re: Anonymous Logon 540

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 08/11/05 

Date: Wed, 10 Aug 2005 20:15:48 -0500

If you have a properly configured firewall protecting your network from the
internet then most likely you do not have a problem. The anonymous logons
are "null sessions" that the operating system uses for various functions
with the most used one being the maintenance of the browse list that you see
in My network Places. If you do not need to share files/printers on your
computer or access other network computer shares/printers you can disable
file and print sharing, Client for Microsoft Networks, and netbios over
tcp/ip and you probably will see those anonymous logon events disappear.
The KB article in the link below explains some of the uses of these
anonymous connections and how to restrict them in Windows 2000 on computers
that need to share and access shares though warning message needs to be
heeded as to the consequences of restricting anonymous access. --- Steve

http://support.microsoft.com/?kbid=246261

"AJang" <AJang@discussions.microsoft.com> wrote in message
news:46EFE80C-EF9A-4A79-A2BC-B039C6F46192@microsoft.com...
> In my computer's security log, I found event with event ID 540 and
> Anonymous
> Logon.
> But in my computer, the guest account is disable; Net Logon service is not
> enable.
> Is this a security problem in my computer ?
>
> Any comment is highly appreciated.
>
>

Relevant Pages

  • Re: Constant Logon/Logoff 538 540
    ... machine resources as well as bandwidth on the Network. ... Type 3 Anonymous logons ... Admin account on ... >give Home Edition users confidence that their systems ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Anonymous Logons
    ... Anonymous logons are used by Windows networking to create null sessions for ... Network Places, and password changes that are implemented before logon. ... sessions from the internet can provide attackers with important information ...
    (microsoft.public.win2000.security)
  • Re: Fast reply Im on the alert
    ... Anonymous logons do not usually indicate a malware attack - they are ... perfectly normal in a Windows network and are called null sessions. ... I had a alert from trend ...
    (microsoft.public.win2000.security)
  • Re: Anonymous Logon 540
    ... > internet then most likely you do not have a problem. ... The anonymous logons ... > in My network Places. ... > that need to share and access shares though warning message needs to be ...
    (microsoft.public.security)
Quantcast