Guest ThomasAJ Posted November 26, 2008 Posted November 26, 2008 I'm a part-time admin on Server 2003. Event Viewer/Security events 538/540 every 15 seconds I get an entry in the log. 'Success Audit....Logon/Logoff....ANONYMOUS LOGON.....'. Can I stop this - is it wise - maybe just not show these events? -- Regards Tom Quote
Guest ThomasAJ Posted November 26, 2008 Posted November 26, 2008 I just realised it's from the 1 workstation - been happening for a long time. The details are: Event Type: Success Audit Event Source: Security Event Category: Logon/Logoff Event ID: 540 Date: 6/11/2008 Time: 11:59:44 AM User: NT AUTHORITY\ANONYMOUS LOGON Computer: MMPA-WS1 Description: Successful Network Logon: User Name: Domain: Logon ID: (0x0,0x37E8C04) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: JUSTIN Logon GUID: - Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 192.168.1.103 Source Port: 0 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. -- Regards Tom "ThomasAJ" wrote: <span style="color:blue"> > I'm a part-time admin on Server 2003. > > Event Viewer/Security events 538/540 every 15 seconds I get an entry in the > log. > 'Success Audit....Logon/Logoff....ANONYMOUS LOGON.....'. > > Can I stop this - is it wise - maybe just not show these events? > > -- > Regards > Tom</span> Quote
Guest gscanga Posted December 3, 2008 Posted December 3, 2008 Hi Thomas, Does the server happen to be running IIS (Web services)? If so, IIS (by default I believe), uses this account for serving up web page requests. "ThomasAJ" wrote: <span style="color:blue"> > I just realised it's from the 1 workstation - been happening for a long time. > The details are: > > Event Type: Success Audit > Event Source: Security > Event Category: Logon/Logoff > Event ID: 540 > Date: 6/11/2008 > Time: 11:59:44 AM > User: NT AUTHORITYANONYMOUS LOGON > Computer: MMPA-WS1 > Description: > Successful Network Logon: > User Name: > Domain: > Logon ID: (0x0,0x37E8C04) > Logon Type: 3 > Logon Process: NtLmSsp > Authentication Package: NTLM > Workstation Name: JUSTIN > Logon GUID: - > Caller User Name: - > Caller Domain: - > Caller Logon ID: - > Caller Process ID: - > Transited Services: - > Source Network Address: 192.168.1.103 > Source Port: 0 > > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > > -- > Regards > Tom > > > "ThomasAJ" wrote: > <span style="color:green"> > > I'm a part-time admin on Server 2003. > > > > Event Viewer/Security events 538/540 every 15 seconds I get an entry in the > > log. > > 'Success Audit....Logon/Logoff....ANONYMOUS LOGON.....'. > > > > Can I stop this - is it wise - maybe just not show these events? > > > > -- > > Regards > > Tom</span></span> Quote
Guest ThomasAJ Posted December 4, 2008 Posted December 4, 2008 No IIS. -- Regards Tom "gscanga" wrote: <span style="color:blue"> > Hi Thomas, > > Does the server happen to be running IIS (Web services)? If so, IIS (by > default I believe), uses this account for serving up web page requests. > > > > "ThomasAJ" wrote: > <span style="color:green"> > > I just realised it's from the 1 workstation - been happening for a long time. > > The details are: > > > > Event Type: Success Audit > > Event Source: Security > > Event Category: Logon/Logoff > > Event ID: 540 > > Date: 6/11/2008 > > Time: 11:59:44 AM > > User: NT AUTHORITYANONYMOUS LOGON > > Computer: MMPA-WS1 > > Description: > > Successful Network Logon: > > User Name: > > Domain: > > Logon ID: (0x0,0x37E8C04) > > Logon Type: 3 > > Logon Process: NtLmSsp > > Authentication Package: NTLM > > Workstation Name: JUSTIN > > Logon GUID: - > > Caller User Name: - > > Caller Domain: - > > Caller Logon ID: - > > Caller Process ID: - > > Transited Services: - > > Source Network Address: 192.168.1.103 > > Source Port: 0 > > > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > > > -- > > Regards > > Tom > > > > > > "ThomasAJ" wrote: > > <span style="color:darkred"> > > > I'm a part-time admin on Server 2003. > > > > > > Event Viewer/Security events 538/540 every 15 seconds I get an entry in the > > > log. > > > 'Success Audit....Logon/Logoff....ANONYMOUS LOGON.....'. > > > > > > Can I stop this - is it wise - maybe just not show these events? > > > > > > -- > > > Regards > > > Tom</span></span></span> Quote
Guest Waffle_Nator Posted April 16, 2009 Posted April 16, 2009 No it's not just because your an admin server.. Because i am a normal home user and i get the same thing.... when i first saw it, i thought i was being hacked. just recently windows showed me a poppup that said something like. (there is a I.P. address confliction within your network). i don't know what it is or even if these 2 situations relate.. Any help would be appreciated. -- Waffle_Nator ------------------------------------------------------------------------ Waffle_Nator's Profile: http://forums.techarena.in/members/90376.htm View this thread: http://forums.techarena.in/microsoft-security/1077838.htm http://forums.techarena.in Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.