User: NT AUTHORITY\ANONYMOUS LOGON is this scary or normal

From: ChrisA (chris_at_nospam.atlas-anchor.com)
Date: 03/05/04

  • Next message: Drew Cooper [MSFT]: "Re: Administrator rights to folder" 
    Date: Fri, 05 Mar 2004 20:16:07 GMT

    Trying to help a small company out with their Windows 2000 server fully
    patched system. Enabled a number of recommended audit policies.

    The following event log shows in the security log quite often. Seems like
    something we should concerned about or is this normal.

    The server is running Terminal Services, DHCP, DNS

    Event Type: Success Audit
    Event Source: Security
    Event Category: Privilege Use
    Event ID: 576
    Date: 04/03/2004
    Time: 7:12:59 PM
    User: NT AUTHORITY\ANONYMOUS LOGON
    Computer: ATLASSERVER
    Description:
    Special privileges assigned to new logon:
      User Name:
      Domain:
      Logon ID: (0x0,0xB693445)
      Assigned: SeChangeNotifyPrivilege

    Thanks
    Chris

  • Next message: Drew Cooper [MSFT]: "Re: Administrator rights to folder"

    Relevant Pages

    • Re: Log File Fill Automatically
      ... clear the security log after logon by administrator. ... after the logoff my user. ... Check the settings for the Security Event Log. ...
      (microsoft.public.win2000.active_directory)
    • Re: Security event id 537
      ... in our Security Log. ... An error occurred during logon ... That is a direct copy of the event log. ... "Logon Process" changes to something similar, ...
      (microsoft.public.windows.server.sbs)
    • Re: obscure logon events?
      ... These don't explain reason of these event entries. ... Logon even: 540 A user successfully logged on to a network. ... You can safely ignore this event log and it should ...
      (microsoft.public.windows.server.sbs)
    • Re: Preparing Network Connections... forever
      ... Windows IP Configuration ... Connection-specific DNS Suffix. ... "Replication Services" event log contained the same error as originally posted. ... The failure code from authentication protocol Kerberos was "There are currently no logon servers ...
      (microsoft.public.windows.server.active_directory)
    • Re: Failure Audit 537 in Event Log
      ... You get the event 537 in SBS event log. ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... | Logon Failure: ...
      (microsoft.public.windows.server.sbs)
    Loading