ANONYMOUS LOGON (WXP-Pro)

[jimbojitsu]

I provide Desktop support on a secure (haha) network. On my PC I set my security audit for logons I keep getting the Anonymous logon hitting my machine. I have googled and found a lot of info that does not apply to me or tell me where these logons are coming from. Here are my questions:
1) Is there some way of tracing the logon back to the user/server it came from?
2) Is there a way to prohibit the logon?

3) should I worry about all these hits? Some have suggested that they are just PC's talking to eachother.

Thanks for the advice/help in advance!!!

[durangochris]

According to microsoft's website, do the following to disable anonymous logon:
Run Registry Editor (Regedt32.exe).
Go to the following key in the registry:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA

On the Edit menu, click Add Value and use the following entry:


Value Name: RestrictAnonymous
Data Type: REG_DWORD
Value: 1

Exit the Registry Editor and restart the computer for the change to take effect.

But if you want to find out who's doing it, I recommend some kind of packet analyzer software. Do not apply the fix, and load your packet analyzer when you think the user will connect again, It should reveal the source IP. I recommend using the trial version of IRIS available at www.download.com. It works great but its a little pricey to buy.

[jimbojitsu]

Thanks for the Reg info. I will look into the the packet info. I am starting to think it is a server on our network, the logon is never for very long, usually under a minute. I would like to be sure though so I will setup the packet software asap. Thanks again for the information and help!