Home / server / Questions / 338644
In Process
Dan
Asked: 2011-12-08 09:39:35 +0800 CST

What are anonymous logons in Windows Event log?

  • 772

I'm playing with a new Win2008 R2 server installed and hosted online with a direct connection to the web (i.e. no separate firewall in front of it).

The server is supposedly locked down with just RDP enabled. It's a fresh install, no software installed or roles/features enabled (apart from RDP). But in about 30 days there were 29,000 failed login attempts, but I was surprised to see a lot of "successful" ones too.

What are the anonymous logons, example below? Should I be concerned?

The workstation name and IP address changes frequently. In the 29,000 failed attempts it looks like bots/hackers are trying to guess the Administrator password.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/10/2011 04:45:11
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WIN-7I8SE0K3F9M
Description:
An account was successfully logged on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

New Logon:
    Security ID:        ANONYMOUS LOGON
    Account Name:       ANONYMOUS LOGON
    Account Domain:     NT AUTHORITY
    Logon ID:       0x376b6c
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:     0x0
    Process Name:       -

Network Information:
    Workstation Name:   SRV001
    Source Network Address: 77.39.106.68
    Source Port:        1242

Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   NTLM V1
    Key Length:     0
security windows-server-2008-r2

1 Answers

    • Event 4624 null sid is the valid event but not the actual user's logon event.
    • The reason for the no network information is it is just local system activity. Windows talking to itself.
    • The "anonymous" logon has been part of Windows domains for a long time--in short, it is the permission that allows other computers to find yours in the Network Neighborhood

    Check this article: http://www.morgantechspace.com/2013/10/event-4624-null-sid-repeated-security.html

    • 3