RE: ANONYMOUS LOGON



"pmsis" wrote:

> Hi ,
> I have disable the above anonymous logon, however i still detect from my
> security event log stating the account have sucessfully logon & logoff?Kindly
> advise on this. Will like to know also is my system have been compromised?
>
> Below is the information from the event log thanks!
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 538
> Date: 4/6/2005
> Time: 12:22:41 AM
> User: NT AUTHORITY\ANONYMOUS LOGON
> Computer: PM
> Description:
> User Logoff:
> User Name: ANONYMOUS LOGON
> Domain: NT AUTHORITY
> Logon ID: (0x0,0x354F8D)
> Logon Type: 3
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 540
> Date: 4/6/2005
> Time: 12:22:40 AM
> User: NT AUTHORITY\ANONYMOUS LOGON
> Computer: PM
> Description:
> Successful Network Logon:
> User Name:
> Domain:
> Logon ID: (0x0,0x354F8D)
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: USER-KGVRTDD2YP
> Logon GUID: -
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: 203.70.230.19
> Source Port: 0
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
.

Relevant Pages

  • RE: How to enable IWA over multiple servers
    ... Boot up computer and logon as ActiveDirectory username (im joe ... a member of 192.168.0.4 (the web server), ... through a local account on the webserver rather than a domain user ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Help Me Resolve Event Errors
    ... > The problem is that each time she logs on, the Event Log records ... > Component: Security Event Log ... > Logon Process: %4 ... > account or a valid user account but with an incorrect password. ...
    (microsoft.public.windowsxp.general)
  • Re: Help with extracting a logon event from Security even log.
    ... reenter their admin space self freedomized to complain. ... How can I get the user name that locked the account. ... > from the event log? ... > Logon Failure: ...
    (microsoft.public.scripting.wsh)
  • Re: Vista and Fax Client on SBS 2003
    ... Could Vista be trying to logon to the domain with the built in system ... account on thw workstation which shouldn't work! ... see Help and Support Center at ...
    (microsoft.public.windows.server.sbs)
  • RE: How to enable IWA over multiple servers
    ... Boot up computer and logon as ActiveDirectory username (im joe bloggs, ... member of 192.168.0.4 (the web server), ... are you logon through a local account on the ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
Loading