Windows 2000 Security Log event error

F

Francine

I received an error in the security log. Event 538 which
represent "log off" of a user. In the user field, it
listed "Annonymous User". Why would this occur. An account
is set up for all users. I don't understand. Help...

FG
 
S

Steven L Umbach

Those are null sessions used by the operating system for things like browser
service and certain password changes. Null sessions can be exploited by
malicious users, particualrly from the internet which is why a properly
configured firewall is needed. I would not be too concerned unless you see a
lot of failed logon in your security logs from non default accounts.
Disabling file and print sharing on computers that do not need it may reduce
or eliminate those events. The link below contains more info. ---- Steve

http://www.eventid.net/display.asp?eventid=538&eventno=7
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Event ID 538 vs 551 - strange behavior 0
Unexplained 540 Events in Security log on W2K workstation in a dom 0
Subject: Security Event Log reading by Domain Users 7
Excessive computer account logon/logoff loggining on security log 5
Event id 538 not being recorded 1
Event Error Logs with Event ID 538 and 540 1
Sessions 2
Auditing User logon/logoff events. 2

Top