Anonymous logon

Hi!

I have found many security event like this one..

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 9.11.2003
Time: 10:59:19
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: BLUEBOX


OS is WinXP SP1.
I'm wondering, who or what cause this audit? I haven't any users or remote
logon support, and guest accaunt is disablet too!


Tnx 4 help!


Greets
D

Damjan

Open your Local Policy Editor and check for your local audit policies.

Jim


Damjan The commander of all things worth commanding said on 11/10/2003
7:56 AM:

> Hi!
>
> I have found many security event like this one..
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 540
> Date: 9.11.2003
> Time: 10:59:19
> User: NT AUTHORITY\ANONYMOUS LOGON
> Computer: BLUEBOX
>
>
> OS is WinXP SP1.
> I'm wondering, who or what cause this audit? I haven't any users or remote
> logon support, and guest accaunt is disablet too!
>
>
> Tnx 4 help!
>
>
> Greets
> D
>
>

Jim

On Mon, 10 Nov 2003 13:56:36 +0100, Damjan <> wrote:
> I'm wondering, who or what cause this audit? I haven't any users or
> remote logon support, and guest accaunt is disablet too!

Are you sure about that one?
Implement something like this http://www.markusjansson.net/exp.html


--
My computer security & privacy related homepage
http://www.markusjansson.net
Use HushTools or GnuPG/PGP to encrypt any email
before sending it to me to protect our privacy.

Markus Jansson

"Damjan" <> wrote in message
news:zVLrb.5378$...
> Hi!
>
> I have found many security event like this one..
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 540
> Date: 9.11.2003
> Time: 10:59:19
> User: NT AUTHORITY\ANONYMOUS LOGON
> Computer: BLUEBOX
>
>
> OS is WinXP SP1.
> I'm wondering, who or what cause this audit? I haven't any users or remote
> logon support, and guest accaunt is disablet too!
>

Does it happen around boot/startup time? It's probably some local service
logging itself on.


DaveK
--
moderator of
alt.talk.rec.soc.biz.news.comp.humanities.meow.mis c.moderated.meow
Burn your ID card! http://www.optional-identity.org.uk/
Help support the campaign, copy this into your .sig!
Proud Member of the Exclusive "I have been plonked by Davee because he
thinks I'm interesting" List Member #<insert number here>
Master of Many Meowing Minions
Holder of the exhalted PF Chang's Crab Wonton Award for kook spankage above
and beyond the call of hilarity.
PGP Key-ID: 0x0FB504D1 Fingerprint 04B7 2E8C 0245 680E 6484 C441 CEC7 D2BD

Dave Korn

> Does it happen around boot/startup time? It's probably some local service
> logging itself on.

yes it happen around boot/startup! which local service do that?

Greets
D

Damjan