Re: NT AUTHORITY\ANONYMOUS LOGON
From: Gordon Fecyk (gordonf_at_pan-am.ca)
Date: 05/19/04
- Next message: Marina Roos [SBS-MVP]: "Re: Outlook Web Access not accessible from the internet"
- Previous message: Sunnie: "Re: Question on email logs"
- In reply to: Robby Pollard: "NT AUTHORITY\ANONYMOUS LOGON"
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 19 May 2004 18:57:05 -0500
> Date 5/12/2004 Source: Security
> Time 4:43:03 PM Category Logon/Logoff
> Type: Success A Event ID: 540
> User: NT AUTHORITY\ANONYMOUS LOGON
> Computer: MAIL
[snip]
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: ZMAN
[snip]
> Source Network Address: 192.168.5.198
[Is this for certain one of your machines? And what OS?]
Windows machines have to connect anonymously to servers to enumerate shares
on the server, among other things. Mostly pre-Win2K machines use anonymous
pipes to do this but Win2K and later can authenticate with the machine's
account - machines as well as users have accounts in NTLM and AD domains.
You can prevent anonymous logons entirely by using the RestrictAnonymous
setting in the Registry or in the Local Security Policy console. Go to
Local Policies / Security Options and change the "Additional Restrictions
for anonymous" settings. If you get stuck, use the MS Baseline Security
Analyzer <http://www.microsoft.com/mbsa/> and it will point out the setting
that needs changing.
You can set this as a domain-wide policy as well, so all machines and users
have to authenticate before doing anything. But there are some badly
written services (*ahem*backupexec*ahem*) that won't work without allowing
some level of anonymous access. Try the first setting "do not allow
enumeration of SAM accounts and shares" and test your services before trying
the second setting "no access without explicit anonymous permissions". And
bug your vendors for fixes for broken services if necessary.
ObExchange2K: Exchange 2000 works with the stronger setting but I believe
client machines will need to be Win2K or later. I'm not sure if there's a
version of Outlook required to work properly with this setting.
-- PGP key (0x0AFA039E): <http://www.pan-am.ca/consulting@pan-am.ca.asc> What's a PGP Key? See <http://www.pan-am.ca/free.html> GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4>
- Next message: Marina Roos [SBS-MVP]: "Re: Outlook Web Access not accessible from the internet"
- Previous message: Sunnie: "Re: Question on email logs"
- In reply to: Robby Pollard: "NT AUTHORITY\ANONYMOUS LOGON"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
