RE: Event Viewer

From: mk (anonymous_at_discussions.microsoft.com)
Date: 01/27/04 

Date: Tue, 27 Jan 2004 06:31:07 -0800

Hi,

I am running XP Home for my home desktop, it is not networked and the guest account is off. I am using the Microsoft firewall, along with Zone Alarm.

The Anonymous Logon appears once the system is booted up, even if I have removed the internet connection.

I had a hardware problem this summer and I had to reload all software. I completely reformatted the harddrive and reinstalled windows XP. Thier was no internet connection during this process, yet this anonymous logon showed up in the event viewer as soon as I booted up the system.

Any help and / or suggestions would be appreciated.
     
     ----- Curtis Koenig [MSFT] wrote: -----
     
     If this is Windows XP and you are using the in-box defualt sharing, this
     indicates that someone accessed a share you created on your machine. By
     defualt a Windows XP computer that is not on a domain uses what is called
     Simple File Sharing, this model uses the local guest account on the
     computer with no password to allow others to access file shares that are
     located on that computer. So the question really comes down to what kind
     of network are you on? and What kind of security are you looking for?
     
     --
     Curtis Koenig
     Support Engineer
     Product Support Services, Security Team
     MCSE, MCSES, CISSP
     
     This posting is provided "AS IS" with no warranties and confers no rights.
     Please reply to the newsgroup so that others may benefit. Thanks!
     
     --------------------
>From: "=?Utf-8?B?TUs=?=" <anonymous@discussions.microsoft.com>>Subject: Event Viewer
>Date: Sun, 25 Jan 2004 15:26:06 -0800
>>Looking in security in my event viewer I notice an anonymous logon. Here
     are the proporties of the Anonymous Logon :
     
     Type : Success Audit
     Event I.D :540
     User: NT AUTHORITY\ANONYMOUS LOGON
     
     Successful Network Logon:
              User Name:
              Domain:
              Logon ID: (0x0,0xEAB7)
              Logon Type: 3
              Logon Process: NtLmSsp
              Authentication Package: NTLM
              Workstation Name:
              Logon GUID: {00000000-0000-0000-0000-000000000000}
     
     Should I be concerned about this ?
     What is Logon Type 3 ?
     How do I disable/Delete this Anonymous Logon ?
     
     GR
     
     
     
      
        
       
     
     
>

Relevant Pages

  • RE: Internet security on "hotspots"
    ... there's a setting in the security policy under Network Access where ... Now if we're talking shares, anonymous never did have access in most cases, ... Disabling the guest account - it's been disabled by default since NT 3.5, ...
    (Focus-Microsoft)
  • Event Viewer - Anonymous Logon
    ... I am running XP Home for my home desktop, it is not networked and the guest account is off. ... of network are you on? ... Product Support Services, Security Team ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Network Shares for ANYONE not EVERYONE - how?
    ... > The scenario is that I wish to share a folder with basically anyone ... > in from various workgroups and domains (we have a huge network here). ... (I am aware of the dangers and security implications). ... Enable Guest account. ...
    (microsoft.public.windows.group_policy)
  • RE: Remote Access
    ... sure how it works if there is a mixture of OSon a workgrouup network. ... there is a Home OS on a Workgroup, that Simple File Sharing has to be used as ... the face of shares and resources on stand alone workstantions. ... privleges the Guest Account provides, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Used to network properly but now Guest account is interfering.
    ... Ethernet adapter Wireless Network Connection: ... Server Comment ... did the guest account become flavour of the month?- it's disabled on both ...
    (microsoft.public.windowsxp.network_web)