ANONYMOUS LOGON without logoff

[bayor]

Hello!
I've got a anonymous logon which has no logoff and the Workstation Name is emtpy.
It occurs a few seconds before I'm logging on with Event 540.


Date: 15.03.2004 Source: Security
Time: 10:08:08 Category: Logon/Logoff
Type: Success Audit Event ID: 540
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: ABAYER

Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0xA371)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}


What could be a reason for that?

thank you for your help

 

[Guest]

disconnect the machine from the router or internet or
whatever. watch. you will probably still see this, because
its probably an application. if not, start by disabling
anonymous login (guest account?) and check your
usermanager. Update your firewall as well. and check who
can access the computer from the net (local security
policy?)

 

[Steven L Umbach]

Windows uses null sessions for some network processes including maintaining and using
the browse list. I doubt it is anyhting to be concerned about, particualry if you are
using a firewall, etc to protect your computer. I see similar events on my computers.
There is a computer name listed - ABAYER. --- Steve

http://www.microsoft.com/security/protect/

 

[bayor]

But "ABAYER" is my computer. I would like to know from which
workstation the logon comes from. In the part of the description you
can see, that here is the workstation name empty.
Is this just any process of the system of my own pc, or is it a logon
from a remote pc?

 

[Steven L Umbach]

It could be a remote computer if you are on a lan such as the browse master. If you
are not on a lan, then you can disable file and print sharing and you will probably
see the messages go away. --- Steve