Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to generate a system alert on a windows 2003 server whenever there is an ANONYMOUS LOGON event in the event viewer?

share|improve this question

In other words, yes you can do this but not out of the box. As mh stated your best bet is to script this, or use a tool for monitoring event logs. There are a number of ways to do what you want.

share|improve this answer

My answer here will probably do what you're looking for with a bit of modification.

Basically, you can install a script, running as a service, to receive notification when new events are posted to the event log and act upon those events.

My script in that answer can be used to monitor events matching a combination of : event log (Application, Security, System, etc), event ID, category, type, user, and a regexp match on the event message. The script, as written there, sends emails. You could easily plumb it to do something else.

share|improve this answer

It depends on what kind of system alert you want. If you're not averse to a bit of coding you could write a Windows Service that periodically scans these logs and looks for what you want, then reacts accordingly. You could also use something like MOM (or whatever it's called this week) or a similar third party application to do the work for you. A third (and cruder) option would be to use the publishing feature of newer Windows OSs and have a Computer Management (or Event Log) window open on your desktop with a filtered view of the security log, periodically hitting F5 to update.

share|improve this answer

If you're in a multi-OS environment and are willing to put some work in, you can setup Windows to send it's logs via syslog to a remote server (such as a Linux server running syslog-ng), and then run a tool such as SEC to keep an eye on the logs and notify you when an anonymous login (or anything) happens.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.