What is 'NT AUTHORITY\ANONYMOUS LOGON' every 15 secs

[ThomasAJ]

I'm a part-time admin on Server 2003.

Event Viewer/Security events 538/540 every 15 seconds I get an entry in the
log.
'Success Audit....Logon/Logoff....ANONYMOUS LOGON.....'.

Can I stop this - is it wise - maybe just not show these events?

--
Regards
Tom

[ThomasAJ]

I just realised it's from the 1 workstation - been happening for a long time.
The details are:

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 6/11/2008
Time: 11:59:44 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: MMPA-WS1
Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x37E8C04)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: JUSTIN
Logon GUID: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.1.103
Source Port: 0

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Regards
Tom

[gscanga]

Hi Thomas,

Does the server happen to be running IIS (Web services)? If so, IIS (by
default I believe), uses this account for serving up web page requests.

[ThomasAJ]

No IIS.

--
Regards
Tom

[Waffle_Nator]

No it's not just because your an admin server.. Because i am a
normal home user and i get the same thing.... when i first saw
it, i thought i was being hacked. just recently windows showed me a
poppup that said something like. (there is a I.P. address
confliction within your network).

i don't know what it is or even if these 2 situations relate..

Any help would be appreciated.

--
Waffle_Nator
------------------------------------------------------------------------
Waffle_Nator's Profile: http://forums.techarena.in/members/90376.htm
View this thread: http://forums.techarena.in/microsoft-security/1077838.htm

http://forums.techarena.in