ANONYMOUS LOGON

From: Mark Warbeck (mwarbeck@adelpia.net)
Date: 01/02/03 

From: "Mark Warbeck" <mwarbeck@adelpia.net>
Date: Thu, 2 Jan 2003 10:36:30 -0500

I run a AD tree with 3 DCs. It's running in mixed mode. All clients are W2K.
I keep getting these anonymous logon entries in my security logs. Here are
two one such entries, one a log on and one a log off:

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 1/2/2003
Time: 10:26:12 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: N301-01
Description:
User Logoff:
  User Name: ANONYMOUS LOGON
  Domain: NT AUTHORITY
  Logon ID: (0x0,0x733FAB4)
  Logon Type: 3

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 1/2/2003
Time: 9:02:03 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: N301-01
Description:
User Logoff:
  User Name: ANONYMOUS LOGON
  Domain: NT AUTHORITY
  Logon ID: (0x0,0x72A0BD9)
  Logon Type: 3

What's generating these entries? I don't allow any anonymous access (at
least I don't think I do). 

--
--
Mark Warbeck
mailto: mwarbeck@adelphia.net

Relevant Pages

  • RE: Security Event Check - ANONYMOUS LOGON
    ... the full security audit is enabled by default so that you are ... Anonymous logon means that it is a null session. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Event Check - ANONYMOUS LOGON
    ... Successful Network Logon: ... Anonymous logon means that it is a null session. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Security event logs
    ... If you are auditing what you want/need, the size is what you get. ... AFAIK there is no way to say "Audit logon success and failure, ... Windows put tens thousand plus entries per day into the security log. ...
    (microsoft.public.windows.group_policy)
  • Re: Windows server 2003 security. How to protect against 100s of invalid logons to the server??
    ... on your server and if it is Windows 2000 be sure to run the IIS ... The anonymous logon events are for null sessions that the ... >my Event Viewer/Security where someone was truing to logon and guess the ...
    (microsoft.public.windows.server.security)
  • Re: Anonymous Logons
    ... My server's security log has several entries for an anonymous logon. ... Event Type: Success Audit ...
    (microsoft.public.win2000.security)