Anon Logon Events 538/540

From: ScareCrowe (nospam_at_nospam.com)
Date: 03/03/05 

Date: Thu, 3 Mar 2005 13:25:36 -0600

I'm sure this has been covered before, but I have not found a satisfactory
solution to the issue. I constantly have the ANONYMOUS LOGON event from a
remote computer (Usually HOD) in my Event Viewer. I have installed several
patches from MS and have denied network logon in both local/domain policies.
I haven't seen any 'working' solutions anywhere on the net. Applying the
patches has considerably affected the successful logons, but it has not
eliminated them.
Has anyone had any success beyond what I have so far? Or can someone answer
some of these questions?

I can't seem to find any log info concerning the IPs of these remote
connections. Does XP store these someplace? The tedious process I have been
using is via cmd line -> 'netstat -a -n 5 > netstat.txt', then filtering
everything out.

The NTLM, is it possible to enforce some authorization that will only
validate PCs that I specifically allow, ignoring any conn request from a PC
not listed?? I only have a handful of boxes here (8) and setting something
up like this I believe will be less work overall (In retrospect).

--ScareCrowe

Relevant Pages

  • RE: Security Event 529...please help....
    ... I have a lab computer with SBS 2003 standard SP1 and all current patches. ... Logon Failure: ... Caller User Name: - ... Caller Domain: - ...
    (microsoft.public.windows.server.sbs)
  • Re: product that scans pc at login for up-to-date patches?
    ... at logon to make sure it has the latest security patches. ... it would not allow them to log into the network. ... Second, if it checks "at" logon, it is probably doing so in a logon script, ...
    (microsoft.public.windows.server.security)
  • Re: Pause Logon While Patching?
    ... logging in, doing a bit of work, and then having to reboot while in the ... > it is downloading and installing patches from SMS? ... > the morning when EVERYONE gets here at the same time and logs on at the ... What I would like to do is pause their logon until the ...
    (microsoft.public.sms.admin)
  • Re: Logon Problem "Command Length is Incorrect"/Please Help
    ... I found something similar to that "no payload, ie the file sizes of the ... > My brother's PChas a problem when Logon is attempted.. ... > The program issued a command but the command length is incorrect." ... > sizes of the patches indicated a size of 0 kb. ...
    (microsoft.public.windowsxp.general)
  • Re: Does SMS 2003 allows me to install patches *at logon* ?
    ... I don't think this is possible, allthough we can install stuff at logon ... > patches will install and reboot the computer. ... Check out the SMS Technical FAQ: ...
    (microsoft.public.sms.admin)