Re: Strange Login events

Most likely those are null sessions used by the browser service to maintain
the browse list which is what users see in My Network Places. To make sure
your computer is secure against anonymous access to your shares make sure
that the guest account is disabled and configure any shares on the computer
to use authenticated users instead of everyone or users where you want to
grant that type of access. Type 2 logons are for interactive or via TS in
Windows 2000 while type 3 is for network access. The link below explains
more on how to restrict null sessions in Windows 2000 that can sometimes
break functionality so keep that in mind if you implement "no access without
explicit anonymous permissions". As long as the guest account is disabled
and you have a firewall to protect your network from untrusted networks such
as the internet I would not worry about those anonymous logon events though
it makes sense to restrict null sessions even more as long as it does not
break anything.

Steve

http://support.microsoft.com/?kbid=246261

The following tasks are restricted when the RestrictAnonymous registry value
is set to 2 on a Windows 2000-based domain controller: . Down-level member
workstations or servers are not able to set up a netlogon secure channel.
. Down-level domain controllers in trusting domains are not be able to
set up a netlogon secure channel.
. Microsoft Windows NT users are not able to change their passwords
after they expire. Also, Macintosh users are not able to change their
passwords at all.
. The Browser service is not able to retrieve domain lists or server
lists from backup browsers, master browsers or domain master browsers that
are running on computers with the RestrictAnonymous registry value set to 2.
Because of this, any program that relies on the Browser service does not
function properly.
Because of these results, it is not recommended that you set the
RestrictAnonymous registry value to 2 in mixed-mode environments that
include down-level clients. Setting the RestrictAnonymous registry value to
2 should only be considered in Windows 2000 environments only, and after
sufficient quality assurance tests have verified that appropriate service
levels and program functionality is maintained.

Note Pre-defined "High Secure" security templates set the RestrictAnonymous
registry value to 2, and because of this, caution should be used when using
these templates. For more information about the RestrictAnonymous registry
value, click the following article number to view the article in the
Microsoft Knowledge Base:


"Andreas Moroder" <Andreas.moroder@[nospam]sb-brixen.it> wrote in message
news:ed3avg$38r$1@xxxxxxxxxxxxxxx
Hello,

yesterday I activated the logging of the logins and now in the security
events I have many logins as "administrator" and as "anonymous".
I am sure that no user logged in at this time in the night.
Are this entries generated by services ?

The event entries differ also in the count of description lines ( only 4 )
and the login Type ( ? Anmeldetyp in German ). The user logins are of type
3 while this entries are of type 2

Can anyone explain me please what happen on this machine ?

Thanks
Andreas


.

Relevant Pages

  • Re: Master Browser List contains phantom domains
    ... browser service stopped for all workstations and let this run only on ... it is a member of a workgroup - perhaps with a workgroup name ... > to the network, their workgroup name will continue to appear in the browse ... >> Master lists that keep propogating back into the browse list of other ...
    (microsoft.public.win2000.networking)
  • Re: 3 workgroup PCs that can ping but unable to see PCs in workgro
    ... >>>All the PCs have teh following services running. ... >> computers on the network at any time. ... Admittedly, the necessity of disabling the browser service is a pain, but in a ... Each client will take these PCs and place in a singe office ...
    (microsoft.public.windowsxp.network_web)
  • Re: Networking 2 XP Pro systems w/ crossover cable
    ... running on both machines. ... This has really got me confused.....I have ran the network setup>>wizard on both computers choosing the appropriate settings for each system. ... Computer B has NIS 2003 ... make sure the browser service is running on each computer. ...
    (microsoft.public.windowsxp.network_web)
  • Re: PDC Not Appearing In Network Neighbourhood !!
    ... I dont know if this will help but the backup DC after a few hours of being ... The browser service has failed to retrieve the backup list too many times on ... >> acting as a primary domain controller on a very small network. ... Ping the machine by IP address all okay ...
    (microsoft.public.windows.server.dns)
  • Re: Windows XP onto win98SE network makes half the 98s disappear
    ... >the network assuming one of the 98's has taken the role of Master Browser? ... computers, Network Neighborhood was correctly showing all computers, right?), ... including the 3 new WinXP computers. ... computers in both groups are trying to provide browser service. ...
    (microsoft.public.windowsxp.network_web)