troubling anonymous Logon events in Windows Security event log

Question

I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears random IPs are successfully "logging in" to my server somehow. How is this possible? I have a very strong Administrator password. Am I overreacting here, or does it look like someone is accessing my server somehow? There are about 50 of these within an hour time span, from different IP addresses.

An account was successfully logged on.

Subject:
 Security ID:  NULL SID
 Account Name:  -
 Account Domain:  -
 Logon ID:  0x0

Logon Type:   3

New Logon:
 Security ID:  ANONYMOUS LOGON
 Account Name:  ANONYMOUS LOGON
 Account Domain:  NT AUTHORITY
 Logon ID:  0x20a394
 Logon GUID:  {00000000-0000-0000-0000-000000000000}

Process Information:
 Process ID:  0x0
 Process Name:  -

Network Information:
 Workstation Name: ATBDMAIN2
 Source Network Address: 76.164.41.214
 Source Port:  36183

Detailed Authentication Information:
 Logon Process:  NtLmSsp 
 Authentication Package: NTLM
 Transited Services: -
 Package Name (NTLM only): NTLM V1
 Key Length:  128

Answer 1

The "anonymous" logon has been part of Windows domains for a long time--in short, it is the permission that allows other computers to find yours in the Network Neighborhood, find what file shares or printers you are sharing, etc.

It is also why Windows admins say never to grant share permissions to the "Everyone" group (unless you know what you are doing), because "Everyone" also includes "no one"--er, ANONYMOUS. Rest assured that unless you

Anyway, in this case you probably want to lock it down with Registy settings or better yet, Local or Group Policies. Look in your policy editor under Computer Configuration\Windows Settings\SecuritySettings\Local Policies\SecurityOptions for the following options:

• Network access: Allow anonymous SID/Name translation
• Network access: Do not allow anonymous enumeration of SAM accounts
• Network access: Do not allow anonymous enumeration of SAM accounts and shares
• Network access: Let Everyone permissions apply to anonymous users
• Network access: Named Pipes that can be accessed anonymously
• Network access: Shares that can be accessed anonymously

Answer 2

So is it likely someone was port scanning or looking for vulnerabilities, or why else would some random IPs from around the world want to know about my server?

Answer 3

Try to access your server by using NetBT (NetBIOS over TCP/IP) type \\your-dedi-ip on windows explorer address bar, and you should see the same logs in your security events of your dedi (even if you don't enter any credentials). If it is, that means your NetBT Port of your server must be open. If you dont use it, you should close them on your firewall (not allow inbound or outbound traffic via TCP ports 135-139).

"At its simplest NetBIOS on your LAN may just be a necessary evil. NetBIOS on your WAN or over the Internet, however, is an enormous security risk. All sorts of information, such as your domain, workgroup and system names, as well as account information is obtainable via NetBIOS. It really is in your best interests to ensure that NetBIOS never leaves your network." >>

Answer 4

I'm getting a ton of these as well. I checked my Local Policies as ewall has stated. Here are the current settings:

• Network access: Allow anonymous SID/Name translation: Disabled
• Network access: Do not allow anonymous enumeration of SAM accounts: Enabled
• Network access: Do not allow anonymous enumeration of SAM accounts and shares: Disabled
• Network access: Let Everyone permissions apply to anonymous users: Disabled
• Network access: Named Pipes that can be accessed anonymously: **Blank
• Network access: Shares that can be accessed anonymously: Not Defined