Event ID 538 ANONYMOUS LOGON

[vvb2]

I keep seeing these events in my security log of server in my Windows 2000 Server farm. I cannot find any pattern to their appearance, and I an trying to figure out what they are. Some days I get no such logs, and some days quite a few. I am not running any web services on these servers, however, they are in a Citrix Metaframe farm. Any ideas would be appreciated. Thanks.


Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 5/17/2002
Time: 11:10:37 PM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: XXXX
Description:
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x1C5763)
Logon Type: 3

 

[OUCATS]

I am also curious what these messages are and why they appear. Anyone have any support?

 

[OUCATS]

I have a followup question then: Why would it be anonymous when I can view user names (or computer names) when they log on and off? I don't understand the anonymous part.

Also, I checked the log again and have some similar events:

Event Type: Success Audit
Event Source: Security
Event Category: Privilege use
Event ID: 576
User: NT AUTHORITY\ANONYMOUS LOGON
Special privileges assigned to new login:
UserName: (blank)
Domain: (blank)
Logon ID: (0x0, 0xBC9E05D)
Assigned: SeChangeNotifyPrivilege

 

[philote]

You can usually get some good stuff by looking up the event it on EventID.Net:

http://www.eventid.net/display.asp?eventid=538&source=Security

http://www.eventid.net/display.asp?eventid=576&source=Security

Kevin
A+, Network+, MCP

 

[OUCATS]

Thanks for the link, it will definitely come in handy going forward.

I am primarily concerned about the Anonymous part of the event. Other events that have the same number have user names or computer names associated with the event.

Thanks!

 

[BWilson77080]

restrict anonymous and see if it gives you issues....HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA should be the location

Are you in mixed mode (NT4 members or BDCs)? If so, do NOT enable the restrict anonymous