Event ID 540 "Anonymous Logon"
Porch Monkey
I was checking out my Event Viewer and noticed a Event ID 540
"Anonymous Logon" listed. Does anyone know what this is. I have looked
at the Microsoft Site and event viewer.net but it just told me it was a
succesful logon and did not say anything anout the "Anonymous" part. I
belive this this just happens when I start up my PC and I have Virus,
firewall (not the XP One) and privacy software so I do not think it
would be a hacker but that Anonymous Logon hade me a little worried.
And yes I am on a webtv (save the jokes, lol) I just use to post in
NG's.
Monkey
Porch Monkey
Source: Security
Category: Logon/Logoff
User: NT AUTHORITY/ANNONYMOUS LOGON
COMPUTER: MYCOMPUTER
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTML
I am the only user and am not on any type of Network. Please email me if
you know what this is or if is anything to worry about.
Monkey
Nicole Wan
According to Event ID 540, I would like to provide the following
information:
If you are auditing Logon and Logoffs, you may see references to an account
called NT AUTHORITY\ANONYMOUS LOGON.
This by itself does not mean a necessarily hacker is trying to break in to
your system. This account will appear when a NULL Session was setup to the
audited
machine. You don't need to worry about it. For more detailed information,
please refer to the following article:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechn
ol/windows2000serv/maintain/monitor/logonoff.asp
Note: Although the article is marked for Windows 2000, it also applies to
Windows XP.
Regards,
Nicole Wan
Nic...@online.microsoft.com
Online Support Professional
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| From: prch...@webtv.net (Porch Monkey)
| Newsgroups: microsoft.public.windowsxp.help_and_support
| Subject: Event ID 540 "Anonymous Logon"
| Date: Mon, 18 Nov 2002 12:56:56 -0800 (PST)
| X-Tomcat-NG: microsoft.public.windowsxp.help_and_support