Hello!
I've got a anonymous logon which has no logoff and the Workstation Name is emtpy.
It occurs a few seconds before I'm logging on with Event 540.


Date: 15.03.2004 Source: Security
Time: 10:08:08 Category: Logon/Logoff
Type: Success Audit Event ID: 540
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: ABAYER

Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0xA371)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}


What could be a reason for that?

thank you for your help

disconnect the machine from the router or internet or
whatever. watch. you will probably still see this, because
its probably an application. if not, start by disabling
anonymous login (guest account?) and check your
usermanager. Update your firewall as well. and check who
can access the computer from the net (local security
policy?)

>-----Original Message-----
>Hello!
>I've got a anonymous logon which has no logoff and the
Workstation Name is emtpy.
>It occurs a few seconds before I'm logging on with Event
540.
>
>
>Date: 15.03.2004 Source: Security
>Time: 10:08:08 Category: Logon/Logoff
>Type: Success Audit Event ID: 540
>User: NT AUTHORITY\ANONYMOUS LOGON
>Computer: ABAYER
>
>Description:
> Successful Network Logon:
> User Name:
> Domain:
> Logon ID: (0x0,0xA371)
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name:
> Logon GUID: {00000000-0000-0000-0000-
000000000000}
>
>
>What could be a reason for that?
>
>thank you for your help
>.
>

Windows uses null sessions for some network processes including maintaining and using
the browse list. I doubt it is anyhting to be concerned about, particualry if you are
using a firewall, etc to protect your computer. I see similar events on my computers.
There is a computer name listed - ABAYER. --- Steve

http://www.microsoft.com/security/protect/

"bayor" wrote in message
news:d12541ad.0404060102.1c3b8457@posting.google.com...
> Hello!
> I've got a anonymous logon which has no logoff and the Workstation Name is emtpy.
> It occurs a few seconds before I'm logging on with Event 540.
>
>
> Date: 15.03.2004 Source: Security
> Time: 10:08:08 Category: Logon/Logoff
> Type: Success Audit Event ID: 540
> User: NT AUTHORITY\ANONYMOUS LOGON
> Computer: ABAYER
>
> Description:
> Successful Network Logon:
> User Name:
> Domain:
> Logon ID: (0x0,0xA371)
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name:
> Logon GUID: {00000000-0000-0000-0000-000000000000}
>
>
> What could be a reason for that?
>
> thank you for your help

But "ABAYER" is my computer. I would like to know from which
workstation the logon comes from. In the part of the description you
can see, that here is the workstation name empty.
Is this just any process of the system of my own pc, or is it a logon
from a remote pc?

"Steven L Umbach" wrote in message news:...
> Windows uses null sessions for some network processes including maintaining and using
> the browse list. I doubt it is anyhting to be concerned about, particualry if you are
> using a firewall, etc to protect your computer. I see similar events on my computers.
> There is a computer name listed - ABAYER. --- Steve
>
> http://www.microsoft.com/security/protect/
>
> "bayor" wrote in message
> news:d12541ad.0404060102.1c3b8457@posting.google.com...
> > Hello!
> > I've got a anonymous logon which has no logoff and the Workstation Name is emtpy.
> > It occurs a few seconds before I'm logging on with Event 540.
> >
> >
> > Date: 15.03.2004 Source: Security
> > Time: 10:08:08 Category: Logon/Logoff
> > Type: Success Audit Event ID: 540
> > User: NT AUTHORITY\ANONYMOUS LOGON
> > Computer: ABAYER
> >
> > Description:
> > Successful Network Logon:
> > User Name:
> > Domain:
> > Logon ID: (0x0,0xA371)
> > Logon Type: 3
> > Logon Process: NtLmSsp
> > Authentication Package: NTLM
> > Workstation Name:
> > Logon GUID: {00000000-0000-0000-0000-000000000000}
> >
> >
> > What could be a reason for that?
> >
> > thank you for your help

It could be a remote computer if you are on a lan such as the browse master. If you
are not on a lan, then you can disable file and print sharing and you will probably
see the messages go away. --- Steve


"bayor" wrote in message
news:d12541ad.0404070049.16d43236@posting.google.com...
> But "ABAYER" is my computer. I would like to know from which
> workstation the logon comes from. In the part of the description you
> can see, that here is the workstation name empty.
> Is this just any process of the system of my own pc, or is it a logon
> from a remote pc?
>
> "Steven L Umbach" wrote in message
news:...
> > Windows uses null sessions for some network processes including maintaining and
using
> > the browse list. I doubt it is anyhting to be concerned about, particualry if you
are
> > using a firewall, etc to protect your computer. I see similar events on my
computers.
> > There is a computer name listed - ABAYER. --- Steve
> >
> > http://www.microsoft.com/security/protect/
> >
> > "bayor" wrote in message
> > news:d12541ad.0404060102.1c3b8457@posting.google.com...
> > > Hello!
> > > I've got a anonymous logon which has no logoff and the Workstation Name is
emtpy.
> > > It occurs a few seconds before I'm logging on with Event 540.
> > >
> > >
> > > Date: 15.03.2004 Source: Security
> > > Time: 10:08:08 Category: Logon/Logoff
> > > Type: Success Audit Event ID: 540
> > > User: NT AUTHORITY\ANONYMOUS LOGON
> > > Computer: ABAYER
> > >
> > > Description:
> > > Successful Network Logon:
> > > User Name:
> > > Domain:
> > > Logon ID: (0x0,0xA371)
> > > Logon Type: 3
> > > Logon Process: NtLmSsp
> > > Authentication Package: NTLM
> > > Workstation Name:
> > > Logon GUID: {00000000-0000-0000-0000-000000000000}
> > >
> > >
> > > What could be a reason for that?
> > >
> > > thank you for your help