RE: successful anonymous login

["Jose Rivera" <jose () papugai com>]

Good question. It's not like a name of a machine on my network. From
research, I think it stands for host on demand. Why this comes up in
this error tho, Im not sure. The ip is definitely from outside.




-----Original Message-----
From: Adam Tuliper [mailto:amt () gecko-software com] 
Sent: Tuesday, July 27, 2004 12:02 PM
To: Jose Rivera; webappsec () securityfocus com
Subject: Re: successful anonymous login

NtLmSsp usually deals with DCOM logins.
What workstation is HOD?

On Tue, 27 Jul 2004 10:59:11 -0700
 "Jose Rivera" <jose () papugai com> wrote:
> We recently migrated our web server into windows 2003.
>
> Not sure where this is coming from...but successful login
> from an
> anonymous user doesn't sound good?
>
> Please help or point in the right direction.
>
> Thanks
> Jose
>
>
> Event Type:   Success Audit
> Event Source: Security
> Event Category:       Logon/Logoff 
> Event ID:     540
> Date:         7/27/2004
> Time:         10:44:20 AM
> User:         NT AUTHORITY\ANONYMOUS LOGON
> Computer:     xxxxxx
> Description:
> Successful Network Logon:
>       User Name:      
>       Domain:         
>       Logon ID:               (0x0,0x9BA1BD3)
>       Logon Type:     3
>       Logon Process:  NtLmSsp 
>       Authentication Package: NTLM
>       Workstation Name:       HOD
>       Logon GUID:     -
>       Caller User Name:       -
>       Caller Domain:  -
>       Caller Logon ID:        -
>       Caller Process ID: -
>       Transited Services: -
>       Source Network Address: 81.60.187.145
>       Source Port:    0
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.

---------------------------------------------------------------------
Web mail provided by NuNet, Inc. The Premier National provider.
http://www.nni.com/