event id 540

[Alan]

we are seeing event id 540 under security logs of few
workstations. the user that genrated the id is someone
else then the workstation owner. So mgmt trying to figure
out what does it mean. does it mean the user tried to
access this workstation remotly.
can someone explain?
thanks

 

[Eric Fitzgerald [MSFT]]

540 is a network logon, it means someone/something accessed the computer
over the network. Absolutely normal to see these for "Anonymous".
Otherwise, could be file sharing, printer sharing, etc.

--
Eric Fitzgerald
Program Manager, Windows Auditing
Microsoft Corporation

The above message is provided "AS-IS" with no warranties, and confers no
rights.

 

[alan]

Why is it normal to see from "Anonymous"?

Also, if it from someone else, does it mean someone logged
on to his machine. if so that would be security issue.?

 

[Rainer Gerhards]

Alan,

these are null session. See here:

http://www.monitorware.com/en/events/details.asp?details_id=14

HTH
Rainer