Re: Event ID 538 Logon Type 3 NT AUTHORITY/ANONYMOUS LOGON


Thanks, that confirms my thinking, and results trying to pare down my
security event log.

I'm doing exactly that now - using EventComb to capture a particular
person's logon and logoff's. Unfortunately, even though I've cranked
up the size of the security log, it still doesn't go back very far due
to all the excess "chatter" by the anonymous logon events. I guess
I'll just have to live with it.

It would be undesirable to disabled NetBIOS , as it is very useful on
occasion to browse to this particular resource server.

I will play around with stopping the Browser service, but so far I
haven't seen it become the master browser - the NT PDC grabs that role
of course, and the BDC's and such snatch up what's left.

Wondering, I am running a WINS server on a separate box from this one.
If everyting is registered properly (a static WINS entry perhaps), could
there be a way to configure that to allow browsing to the resource
server, yet leave NetBIOS disabled?



--
joescat
------------------------------------------------------------------------
Posted via http://www.mcse.ms
------------------------------------------------------------------------
View this thread: http://www.mcse.ms/message1479326.html

.

Relevant Pages

  • Re: Monitoring VPN access to SBS2003
    ... > If it is assigned by DHCP service of SBS server, ... > Eric Sun, ... > | I forgot about the security event log. ...
    (microsoft.public.windows.server.sbs)
  • Re: exchange 2003 two virtual servers authentication problem
    ... Looking at the Security event log, ... failure messages like this that corresponded with the times of the email ... server to the BackConnectionHostNames value. ... and the second virtual server was authenticating just fine! ...
    (microsoft.public.exchange.admin)
  • Re: You do not have access to this session.
    ... This probably is not a licensing issue. ... It is more likely that your security event log is full and your ... >> the local admin account, ... >> server and under the RDP connection under Terminal Server Configuration ...
    (microsoft.public.win2000.security)
  • Event ID 538 Logon Type 3 NT AUTHORITY/ANONYMOUS LOGON
    ... The security event log on our W2K, SP4 server has hundreds of the above ... File and Print sharing is enabled on this server. ... AUTHORITY/ANONYMOUS LOGON events absolutely dwarfs the number of "known user" ... 'Known user' logon/logoff events are present for both ...
    (microsoft.public.win2000.security)
Loading