I'm getting this logon in the event log and am having trouble tracking down
what exactly is the SField Process and why is it using anonymous logon
without a workstation name. Appreciate your help.

Event ID: 540
NT AUTHORITY\ANONYMOUS LOGON
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x18905)
Logon Type: 3
Logon Process: SField
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: