Re: Anonymous Logon

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 03/25/05


Date: Thu, 24 Mar 2005 21:46:17 -0600

Anonymous logons [null sessions] are common with Windows networking and
mostly used by browse list maintenance for My Network Places. If you disable
netbios over tcp/ip or file and print sharing on a computer the anonymous
logons can be greatly reduced or eliminated. They are not a problem if you
have a firewall protecting your network, enforce the use of complex
passwords for your network, and monitor for unusual activity for failed
logon attempts.. --- Steve

http://support.microsoft.com/?kbid=246261 --- explanation of null sessions
and how to restrict them IF compatible with your network configuration.

"Preacher Man" <SLawson@-no-spam-bouldincorp.com> wrote in message
news:eR5J2h8LFHA.1472@TK2MSFTNGP14.phx.gbl...
>I am having several Anonymous Logon entries in my security log in Windows
>2K Server. Please answer the following questions if possible.
>
> 1. How can I track down to see exactly what the Anonymous logon client is
> accessing?
>
> 2. How can I determine where or how the Anonymous logon client is
> accessing from?
>
> 3. Does the system have to have Anonymous Logon, and if not can I disable
> it?
>
> Thanks for your help.
>
>



Relevant Pages

  • What is the Event Viewer telling me?
    ... I just found the event viewer in the program menu under admin tools. ... click the Security tab it lists what looks like a series of network events. ... Anonymous Logon! ...
    (microsoft.public.windowsxp.network_web)
  • What is the event Viewer telling me?
    ... I just found the event viewer in the program menu under admin tools. ... click the Security tab it lists what looks like a series of network events. ... My concern is that every few hours there is an entry of event 540 with user ... Anonymous Logon! ...
    (microsoft.public.windowsxp.basics)
  • anonymous logon problems
    ... I removed everyone from allow access to the server from the network. ... I added ANONYMOUS logon to the deny logon to the network. ... I removed everyone from the security permissions on the root drives. ...
    (microsoft.public.windows.server.general)
  • Re: Anonymous Logons
    ... Anonymous logons are used by Windows networking to create null sessions for ... Network Places, and password changes that are implemented before logon. ... sessions from the internet can provide attackers with important information ...
    (microsoft.public.win2000.security)