HELP - Secuirity Issues in XP Event IDs 540 and 538

[SkateZilla]

ok, Im not sure if its a good or bad thing,

but so far there are no side effects, but pretty much since DAY 1 Of Building this Rig and Loading XP SP2

I Get Event IDs 539 and 540 at the same time, over and over again all day, All Anonymous Logins..

Coming From :
Logon Process: NtLmSsp
Authentication Package: NTLM

And they are all Coming from anther XP SP2 PC on my Network (in another Room of my house)....

I was just wondering if this is someone trying to do something stupid with my network or if its just the XP systems communicating with each other?

IM not sure but i think the other XP system has the same type of excessive events.

Im Also getting these Entries when My Modem is OFFLINE w/ the ISP, and My Network is Wired and Firewalled and Passworded.

 

[altheman]

Now that you mention it, I have the same entries as well. After some googling, I found this article:

In many cases, the user listed for this event will be "ANONYMOUS LOGON" from "NT AUTHORITY" domain. This logon is used by processes that use the null session logons (logons that do not require a user/password combination). Any program or service that is using the System user account is in fact logging in with null credentials.
If the operating system encounters a user without any credentials, the user is regarded as having NULL credentials. When the system attempts to access a secured network resource based on NULL credentials, this is referred to as a NULL session.

Source: http://www.eventid.net/display.asp?eventid=538&eventno=7&source=Security&phase=1

I think this is a safe entry, but hopefully someone else'll confirm they have the same entries.

 

[mickzer]

Hi
I have the Event 540 only and only since 29/7/2006.
mickzer