Any W2K server experts:)? - GoFuckYourself.com

justsexxx · 07-04-2003, 05:32 AM

I was checking the logs and saw this

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 7/3/2003
Time: 11:33:52 PM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: SERVERNAME
Description:
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x129DE9)
Logon Type: 3

THis logon was successfull, is this a standard windows user, like the SYSTEM, and doesn't do anything, or is this a successfull login by another person?

Andre

crescentx · 07-04-2003, 05:42 AM

Been a while since I used NT, but Google found the security FAQ, this a logoff (538) which doesn't record username apparently

"If it is 3 (Network logon), so it is a network logon/logoff. Such an event occurs, if a user connects to a share, for instance. There is also a setting on the server called "Autodisconnect if a session is idle more than x min", with a default of 15 min. So even if a user is connected to a share for hours, you can get a lot of such events because the server will disconnect after the idle time and reconnect if the share is accessed the next time. This is transparent to the user."

-doug

nobull · 07-04-2003, 06:41 AM

It is nothing, your system account just accessed a local resource.

justsexxx · 07-04-2003, 07:04 AM

Thnx all

Andre

07-04-2003, 05:32 AM	#1
justsexxx Too lazy to set a custom title Join Date: Aug 2001 Location: The Netherlands Posts: 13,723	Any W2K server experts:)? I was checking the logs and saw this Event Type: Success Audit Event Source: Security Event Category: Logon/Logoff Event ID: 538 Date: 7/3/2003 Time: 11:33:52 PM User: NT AUTHORITY\ANONYMOUS LOGON Computer: SERVERNAME Description: User Logoff: User Name: ANONYMOUS LOGON Domain: NT AUTHORITY Logon ID: (0x0,0x129DE9) Logon Type: 3 THis logon was successfull, is this a standard windows user, like the SYSTEM, and doesn't do anything, or is this a successfull login by another person? Andre __________________ Questions? ICQ: 125184542

07-04-2003, 05:42 AM	#2
crescentx Confirmed User Join Date: Jun 2003 Posts: 317	Been a while since I used NT, but Google found the security FAQ, this a logoff (538) which doesn't record username apparently "If it is 3 (Network logon), so it is a network logon/logoff. Such an event occurs, if a user connects to a share, for instance. There is also a setting on the server called "Autodisconnect if a session is idle more than x min", with a default of 15 min. So even if a user is connected to a share for hours, you can get a lot of such events because the server will disconnect after the idle time and reconnect if the share is accessed the next time. This is transparent to the user." -doug __________________ XYCash International Gay Affiliate Program

07-04-2003, 06:41 AM	#3
nobull Confirmed User Join Date: Oct 2002 Location: Las Vegas Posts: 1,256	It is nothing, your system account just accessed a local resource. __________________ NOREBILLS -- MAKE CASH NOW WITH THE NEWEST IDEA IN ONLINE PORN!

07-04-2003, 07:04 AM	#4
justsexxx Too lazy to set a custom title Join Date: Aug 2001 Location: The Netherlands Posts: 13,723	Thnx all Andre __________________ Questions? ICQ: 125184542