Announcement

Collapse
No announcement yet.

anonymous logon

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • anonymous logon

    greetings!

    while checking my event viewer, an anonymous logon is listed. how can i trace this user/pc? is this normal?

    also, under user column, some entries indicates the computer name$ not the username. does it mean that its not part of the domain?

    thanks

  • #2
    Re: anonymous logon

    Why not copy the event to the clipboard and paste it in your post?
    Cheers,

    Rick

    ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

    2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

    Comment


    • #3
      Re: anonymous logon

      thanks for the reply

      here is a part of the security log. please see attachment.
      Attached Files

      Comment


      • #4
        Re: anonymous logon

        Take one of those anonymous logons in the event viewer, open it (double click), then click on the icon showing two stagged pieces of paper (copy) and paste that in a post here.
        Last edited by rvalstar; 12th November 2006, 21:09. Reason: made my request more specific
        Cheers,

        Rick

        ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

        2006-2099 R Valstar. This post is offered "as is" for discussion purposes only with no express or implied warranty of any kind including, but not limited to, correctness or fitness for use. Nothing herein shall be construed as advice. Attempting any activity based on information in this post is done at your own risk.

        Comment


        • #5
          Re: anonymous logon

          Event Type: Success Audit
          Event Source: Security
          Event Category: Logon/Logoff
          Event ID: 538
          Date: 11/11/2006
          Time: 7:01:41 AM
          User: NT AUTHORITY\ANONYMOUS LOGON
          Computer: SERVER
          Description:
          User Logoff:
          User Name: ANONYMOUS LOGON
          Domain: NT AUTHORITY
          Logon ID: (0x0,0x32E2671)
          Logon Type: 3


          For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

          Comment


          • #6
            Re: anonymous logon

            Event ID: 538
            1 1 was a racehorse.
            2 2 was 1 2.
            1 1 1 1 race 1 day,
            2 2 1 1 2

            Comment


            • #7
              Re: anonymous logon

              Specifically:
              In many cases, the user listed for this event will be "ANONYMOUS LOGON" from "NT AUTHORITY" domain. This logon is used by processes that use the null session logons (logons that do not require a user/password combination). Any program or service that is using the System user account is in fact logging in with null credentials.
              If the operating system encounters a user without any credentials, the user is regarded as having NULL credentials. When the system attempts to access a secured network resource based on NULL credentials, this is referred to as a NULL session. Access is only allowed if the remote machine allows NULL session access. This is configurable through the registry. (See Knowledge Base article M122702 for more information.)
              One typical example is a computer that register itself with the Master Browser for that network segment at startup. This registration will generate several logon/logoffs from "ANONYMOUS USER". Since the registration is renewed by default every 12 minutes, such events will occur at regular intervals.
              From http://www.eventid.net/display.asp?e...curity&phase=1
              Regards,
              Jeremy

              Network Consultant/Engineer
              Baltimore - Washington area and beyond
              www.gma-cpa.com

              Comment

              Working...
              X