NT AUTHORITY\ANONYMOUS LOGON

[Guest]

I have several occasion have this message does anyone know what it means? i
think i have someone getting into my computer is that correct?


Domain:
Logon ID: (0x0,0xC26CC4)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: OEMCOMPUTER
Logon GUID: {00000000-0000-0000-0000-000000000000}

 

[Steven L Umbach]

It is normal to see these "null sessions" on a Windows computer. They can be
used for primarily networking functions such as maintenance of the browse
list that you see when you open My Network Places. However they could also
indicate that a user has unauthenticated access to a share on your computer.
In XP Home that is unavoidable since XP Home can only use simple file
sharing. If you do not want to offer shares on an XP Home computer then
disable file and print sharing on it. If you do want to offer shares then
make sure that you only share folders that you want anyone to be able to
access and of course use a firewall to protect your network.

For XP Pro computers to make sure that unauthenticated access can not be
made to network shares be sure to disable simple file sharing in Windows
Explorer/tools/folder options - view and uncheck the last option for use
simple file sharing. Also in XP Pro if you do not want to allow
unauthenticated access make sure the guest account is disabled because if it
is enabled then unauthenticated access could be allowed to shares that
include everyone for share and folder/NTFS permissions. The command net user
guest to quickly check the status of the guest account. Another thing I do
on my computers for XP Pro is to open Local Security Policy via secpol.msc
and go to local policies/user rights and find the user right for access this
computer from the network. I remove everyone and users and add authenticated
users. That will prevent unauthenticated access to a share even if the guest
account becomes enabled.

Steve