Windows 2000 Security Log event error

  • Thread starter Thread starter Francine
  • Start date Start date
F

Francine

I received an error in the security log. Event 538 which
represent "log off" of a user. In the user field, it
listed "Annonymous User". Why would this occur. An account
is set up for all users. I don't understand. Help...

FG
 
Those are null sessions used by the operating system for things like browser
service and certain password changes. Null sessions can be exploited by
malicious users, particualrly from the internet which is why a properly
configured firewall is needed. I would not be too concerned unless you see a
lot of failed logon in your security logs from non default accounts.
Disabling file and print sharing on computers that do not need it may reduce
or eliminate those events. The link below contains more info. ---- Steve

http://www.eventid.net/display.asp?eventid=538&eventno=7
 
Back
Top