Windows Forum

Ask something
Discussion Locked

Anoymous login in windows 2000

0 helpful
1 reply

by trackme 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi ,
I have win2k pro with SP2 ,I have only 4 users created which includes the guest and administrator ,and one with user level access and one with administrative previlege user ..So totally i have only 4 users in this ...
Recently when i saw security log i saw that some user anonymoys logon user logged in ..
below is the descritpion
Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 5/28/2003
Time: 11:50:33 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: SMC2176
Description:
Special privileges assigned to new logon:
User Name:
Domain:
Logon ID: (0x0,0x71FF)
Assigned: SeChangeNotifyPrivilege
I have no idea who is this is User ,is it normal ,is it a securitybreach ..
Please help me
regards
Anantha krishnan

1 reply

by d.walker5

One of the more common reasons you'll see anonymous logon events is someone attempting to access one of the anonymously-allowed registry paths defined in:
►HKLM\System\CurrentControlSet\Control\SecurePipeServers\w inreg\AllowedPaths in the "Machine" value. These include:

>System\CurrentControlSet\Control\ProductOptions
>System\CurrentControlSet\Control\Print\Printers
>System\CurrentControlSet\Control\Server Applications
>System\CurrentControlSet\Services\Eventlog
>Software\Microsoft\OLAP Server
>Software\Microsoft\Windows NT\CurrentVersion
>System\CurrentControlSet\Control\ContentIndex
>System\CurrentControlSet\Control\Terminal Server
>System\CurrentControlSet\Control\Terminal Server\UserConfig
>System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration

I suggest you logon as Administrator. Start | Run |MMC |Add | Group Policy |Windows Settings |Security |Local |Security option. Top entry, right hand pane, Add'l Restrictions for Anonymous Users, Left click SECURITY. In drop down box select: "o Access without explicit Anonymous Permission."

Also, install a Firewall, e.g. Zone Alarm.

This discussion is closed to new replies.