Event Viewer

[Guest]

Looking in security in my event viewer I notice an anonymous logon. Here are the proporties of the Anonymous Logon :

Type : Success Audit
Event I.D :540
User: NT AUTHORITY\ANONYMOUS LOGON

Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0xEAB7)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

Should I be concerned about this ?
What is Logon Type 3 ?
How do I disable/Delete this Anonymous Logon ?

GR

 

[Curtis Koenig [MSFT]]

If this is Windows XP and you are using the in-box defualt sharing, this
indicates that someone accessed a share you created on your machine. By
defualt a Windows XP computer that is not on a domain uses what is called
Simple File Sharing, this model uses the local guest account on the
computer with no password to allow others to access file shares that are
located on that computer. So the question really comes down to what kind
of network are you on? and What kind of security are you looking for?

--
Curtis Koenig
Support Engineer
Product Support Services, Security Team
MCSE, MCSES, CISSP

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

--------------------

From: "=?Utf-8?B?TUs=?=" <[email protected]>
Subject: Event Viewer
Date: Sun, 25 Jan 2004 15:26:06 -0800

Looking in security in my event viewer I notice an anonymous logon. Here

are the proporties of the Anonymous Logon :

Type : Success Audit
Event I.D :540
User: NT AUTHORITY\ANONYMOUS LOGON

Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0xEAB7)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

Should I be concerned about this ?
What is Logon Type 3 ?
How do I disable/Delete this Anonymous Logon ?

GR

 

[Guest]

Hi,

I am running XP Home for my home desktop, it is not networked and the guest account is off. I am using the Microsoft firewall, along with Zone Alarm.

The Anonymous Logon appears once the system is booted up, even if I have removed the internet connection.

I had a hardware problem this summer and I had to reload all software. I completely reformatted the harddrive and reinstalled windows XP. Thier was no internet connection during this process, yet this anonymous logon showed up in the event viewer as soon as I booted up the system.

Any help and / or suggestions would be appreciated.

----- Curtis Koenig [MSFT] wrote: -----

If this is Windows XP and you are using the in-box defualt sharing, this
indicates that someone accessed a share you created on your machine. By
defualt a Windows XP computer that is not on a domain uses what is called
Simple File Sharing, this model uses the local guest account on the
computer with no password to allow others to access file shares that are
located on that computer. So the question really comes down to what kind
of network are you on? and What kind of security are you looking for?

--
Curtis Koenig
Support Engineer
Product Support Services, Security Team
MCSE, MCSES, CISSP

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

--------------------are the proporties of the Anonymous Logon :

Type : Success Audit
Event I.D :540
User: NT AUTHORITY\ANONYMOUS LOGON

Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0xEAB7)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

Should I be concerned about this ?
What is Logon Type 3 ?
How do I disable/Delete this Anonymous Logon ?

GR

 

[Curtis Koenig [MSFT]]

Is that the only instance recorded for that longon or has it continued to
occur?
--
Curtis Koenig
Support Engineer
Product Support Services, Security Team
MCSE, MCSES, CISSP

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

--------------------

From: "=?Utf-8?B?bWs=?=" <[email protected]>
Subject: RE: Event Viewer
Date: Tue, 27 Jan 2004 06:31:07 -0800

Hi,

I am running XP Home for my home desktop, it is not networked and the guest
account is off. I am using the Microsoft firewall, along with Zone Alarm.

The Anonymous Logon appears once the system is booted up, even if I have
removed the internet connection.

I had a hardware problem this summer and I had to reload all software. I
completely reformatted the harddrive and reinstalled windows XP. Thier was
no internet connection during this process, yet this anonymous logon showed
up in the event viewer as soon as I booted up the system.

Any help and / or suggestions would be appreciated.

 

[Guest]

Happens everytime I turn the computer on, the log shows muiltiple logins / logoffs with the Anonymous Login


----- Curtis Koenig [MSFT] wrote: ----

Is that the only instance recorded for that longon or has it continued to
occur
-
Curtis Koeni
Support Enginee
Product Support Services, Security Tea
MCSE, MCSES, CISS

This posting is provided "AS IS" with no warranties and confers no rights
Please reply to the newsgroup so that others may benefit. Thanks

-------------------
I am running XP Home for my home desktop, it is not networked and the guest
account is off. I am using the Microsoft firewall, along with Zone Alarm

The Anonymous Logon appears once the system is booted up, even if I have
removed the internet connection

I had a hardware problem this summer and I had to reload all software. I
completely reformatted the harddrive and reinstalled windows XP. Thier was
no internet connection during this process, yet this anonymous logon showed
up in the event viewer as soon as I booted up the system

Any help and / or suggestions would be appreciated

 

[Curtis Koenig [MSFT]]

You might have a 3rd party service or application that is logging on to
another service on your computer and using the guest account. You might
want to scan your machine for spyware just to be sure. The guest account
should be disabled and if it is and the firewall is on then no-one should
be able to access your machine across the network with the guest account.
--
Curtis Koenig
Support Engineer
Product Support Services, Security Team
MCSE, MCSES, CISSP

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

--------------------

From: "=?Utf-8?B?TUs=?=" <[email protected]>
Subject: RE: Event Viewer
Date: Wed, 28 Jan 2004 11:56:06 -0800

Happens everytime I turn the computer on, the log shows muiltiple logins /

logoffs with the Anonymous Login.