I seem to be getting a lot of these entries in the Security event viewer. Around 8-12 every hour. I am wondering if a) I should be worried about it? or b) what actually is going on, Can anyone help?
Type: Success Audit Source: Security Category: Logon/Logoff User: Network Service or IUSR_WIN2003 Logon attempt using explicit credentials: Logged on user: User Name: NETWORK SERVICE Domain: NT AUTHORITY Logon ID: (0x0,0x3E4) Logon GUID: - User whose credentials were used: Target User Name: IUSR_WIN2003 Target Domain: WILDEBB1 Target Logon GUID: - Target Server Name: localhost Target Server Info: localhost Caller Process ID: 13224 Source Network Address: - Source Port: -
Also just after this one was recorded iis stopped accepting connections and I had to reboot the server. The difference to this one is that the logon process used ADVAPI...
Event Type: Success Audit Event Source: Security Event Category: Logon/Logoff Event ID: 540 Date: 05/06/2012 Time: 13:59:10 User: WILDEAA1\IUSR_WIN2003 Computer: WILDEAA1 Description: Successful Network Logon: User Name: IUSR_WIN2003 Domain: WILDEAA1 Logon ID: (0x0,0x5FDB22D) Logon Type: 8 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: WILDEAA1 Logon GUID: - Caller User Name: NETWORK SERVICE Caller Domain: NT AUTHORITY Caller Logon ID: (0x0,0x3E4) Caller Process ID: 13224 Transited Services: - Source Network Address: - Source Port: -