Windows Forum

Ask something
Discussion Locked

Windows 2000

0 helpful
3 replies

by kdyck

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have enabled auditing on my Win2k pro machine and have restricted access to everybody but myself and the team I work with. When I check the event log (security) sometimes I see a SUCCESS audit for logon/logoff (event ID: 538) for ANONYMOUS LOGON. If I have locked out everybody but myself and my group of peers, how come this event is getting logged?

3 replies

by raffi_

Win2K creates, by default, a number of "internal" groups. One of these is "anonymous logon".

Because you cannot alter the membership of these groups, the groups are not listed in Active Directory Users and Computers. However, these groups are used for operations such as assigning permissions to directories, files, shared network directories, or printers. I do not know precisely which service is triggering your anonymous login but a little more digging in the KB should resolve that.

Regards
Raffi_

This discussion is closed to new replies.