Why are there repeated Event 540 and Event 538 entries every 10 minutes?

[Tom Snoiker]

I have a small home network (XP pro SP2 and XP Home SP2 ), and in
checking the Event Log on my XP Pro box, the XP Home (Les1) shows up
, as repeated logon / logoff sequences as posted below. All have the
exact same timestamp .

There are some shares on both computers , but other than that no
traffic or communication is taking place between the systems, they are
simply sharing a Linksys router.


Seems odd to me that this activity is taking place. Could someone
offer an explanation?

Tom

-----------------------------------------------------------------------------------------------------------------------

(event 540)

Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x1168024)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: LES1
Logon GUID: {00000000-0000-0000-0000-000000000000}

(Event 538)
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x1168024)
Logon Type: 3

(event 540)

Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x1168034)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: LES1
Logon GUID: {00000000-0000-0000-0000-000000000000}

(Event 538)
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x1168034)
Logon Type: 3

 

[Steven L Umbach]

That is normal to see. Most likely it is caused by the computer browser
service and computers acting as master browsers and backup browsers
communicating to maintain the browse list that you see in My Network Places
which also uses null sessions that create the anonymous logon events. You
can use the command nbtstat -n to see if a computer is a master browser.
Type 3 logons are network logons. Of more concern would be to see numerous
failed logons to especially the administrator account that would indicate
possible worm or hacking activity. -- Steve

 

[Tom Snoiker]

Actually , its the VMware network adapters that have this entry ,
not my real adapter. Guess its nothing to worry about.