sm5w2 0 Posted February 24, 2005 Occasionally I see a pair of entries in the event viewer security log that are attributed to "anonymous user". Event 1: Event ID: 528 User: NTAuthority/anonymous Computer: (name of computer) Source: Security Type: Success Audit Catagory: Logon/Logoff Description: Successful Logon: User Name: (blank) Domain (blank) Login Id: (0x0,0x3639) Logon Type: 3 Logon Process: KSecDD Authentication Process: Microsoft_Authentication_Package_V1_0 Workstation name: (blank) Event 2: Event ID:576 User: NT Authority/anonymous Computer: (name of computer) Source: Security Type: Success Audit Catagory: Privilege Use Description: Special privileges assigned to new logon: User name; (blank) Domain: (blank) Login ID: (0x0,0x3635) Assigned: SechangeNotifyPrivilege They come in pairs, same date and time stamp. the item "0x36nn" seems to change a little, but it's always "0x36nn". The item (blank) is really blank, empty space. The item (name of computer) is the name of the workstation. There is no "anonymous" user in the user manager. System is NT4 server, SP6. Should I be concerned with these items? If not, what are they? Why is their no user name printed? What is the Login ID? Share this post Link to post
sm5w2 0 Posted February 24, 2005 Sorry, should have posted this in another forum... Share this post Link to post
