I have enabled auditing on my Win2k pro machine and have restricted access to everybody but myself and the team I work with. When I check the event log (security) sometimes I see a SUCCESS audit for logon/logoff (event ID: 538) for ANONYMOUS LOGON. If I have locked out everybody but myself and my group of peers, how come this event is getting logged?
