Event ID 4624 Successful (Anonmymous) Logon

mwade

Member
Hello,

I have a system that many Event ID 4624 Successful (Anonmymous) Logon with the corresponding 4634 Logoff's. The account name is ANONYMOUS, with NO network information what so ever on any of the event entries with the account domain as NT AUTHORITY. There is a total of 1185 over a 12 month period.
These are all Logon Type 3 (network)
Are there any legitimate reasons for this? How come there is NO source IP or workstation name listed on any of these? This is on a Windows Vista system. There is an a IIS_IUSR account, but the system is not suppose to be running a webservice. Though not sure how I can check. Is there any registry keys that would show this? All I have is a dead system image, and I can't boot it up.
Thanks,
 

My Computer

Hmmmm...


Network (i.e. connection to shared folder on this computer from elsewhere on network)
(logon type 3).

I would remove remote access if you have this established. I'm not knowledgeable about this message and it may refer to something innocent, but let's go ahead and close access if that is currently available.
 

My Computer

System One

  • Manufacturer/Model
    Custom
    CPU
    AMD AM2 6000+
    Motherboard
    Nvidia M2N-E SLI
    Graphics Card(s)
    GeForce 7600GT
    Screen Resolution
    1280x1024
    Hard Drives
    WD
    Case
    Cooler Master
    Cooling
    Three fans
    Keyboard
    Dell Quietkey
    Mouse
    Dell Optical
    Internet Speed
    10 MBPS
Back
Top