The question. Have recently begin to Audit succesful/unsuccesful logons. Since this change numerous audits for anonymous are being recorded
averaging one every minute. Monitoring the network traffic to this server for a 24hr period reveals nothing unusual. Yet, I can’t reason why this occurs.
Here is the recorded event :
Source : Security Catagory: Logon/Logoff
Type: Success Event ID: 538
User Logoff:
User Name: Anonymous Logon
Domian: NT Authority
Logon ID: (0x0,0x4fdf38)
Logon type: 3
Operating System : Win2000 5.0 service pack 4 Terminal server
Thanks in advance, to any responders.