Any W2K server experts:)?
 

I was checking the logs and saw this


Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 7/3/2003
Time: 11:33:52 PM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: SERVERNAME
Description:
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x129DE9)
Logon Type: 3



THis logon was successfull, is this a standard windows user, like the SYSTEM, and doesn't do anything, or is this a successfull login by another person?

Andre

Been a while since I used NT, but Google found the security FAQ, this a logoff (538) which doesn't record username apparently

"If it is 3 (Network logon), so it is a network logon/logoff. Such an event occurs, if a user connects to a share, for instance. There is also a setting on the server called "Autodisconnect if a session is idle more than x min", with a default of 15 min. So even if a user is connected to a share for hours, you can get a lot of such events because the server will disconnect after the idle time and reconnect if the share is accessed the next time. This is transparent to the user."

-doug

It is nothing, your system account just accessed a local resource.

Thnx all

Andre