Knowledgebase
annonymous logon
| Posted by giadich, 12-24-2011, 07:33 PM | | I review the sec log and found some entries like these:
An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: ANONYMOUS LOGON
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x398168
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: SERCICTT
Source Network Address: 200.71.246.62
Source Port: 1925
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): NTLM V1
Key Length: 0
Can someone explain what this is?
|
| Posted by 8088, 12-24-2011, 07:39 PM | | It's the sec log.
|
| Posted by SafeSrv, 12-24-2011, 08:10 PM | | The computer browser service maintains a list that is used by "My Network Places" and browse list maintenance uses "null" connections and most likely explains why you see the anonymous logon events in the security log.
|
| Posted by giadich, 12-24-2011, 09:21 PM | | The thing that worries me is that the IP address listed as the source is from a completely different network. Is that typical?
|
| Posted by SafeSrv, 12-25-2011, 05:10 AM | | Have you disabled ANONYMOUS LOGON "
|
| Posted by giadich, 12-25-2011, 10:14 PM | | It's a web server so anonymous logon is required.
|
|
 Add to Favourites
 Print this Article
|
Also Read
Mail Issue ? (Views: 587)
