I'm playing with a new Win2008 R2 server installed and hosted online with a direct connection to the web (i.e. no separate firewall in front of it).

The server is supposedly locked down with just RDP enabled. It's a fresh install, no software installed or roles/features enabled (apart from RDP). But in about 30 days there were 29,000 failed login attempts, but I was surprised to see a lot of "successful" ones too.

What are the anonymous logons, example below? Should I be concerned?

The workstation name and IP address changes frequently. In the 29,000 failed attempts it looks like bots/hackers are trying to guess the Administrator password.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/10/2011 04:45:11
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WIN-7I8SE0K3F9M
An account was successfully logged on.

    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

New Logon:
    Security ID:        ANONYMOUS LOGON
    Account Name:       ANONYMOUS LOGON
    Account Domain:     NT AUTHORITY
    Logon ID:       0x376b6c
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:     0x0
    Process Name:       -

Network Information:
    Workstation Name:   SRV001
    Source Network Address:
    Source Port:        1242

Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   NTLM V1
    Key Length:     0
  • 2
    You might want to double check that firewall, the default is much more open than you might expect (personally I think firewalls should all default to "deny all" until configured, but the zillions of clueless admins in the world easily drown me complaining they can't figure out why their severs wont connect). – Chris S Dec 8 '11 at 0:20
  • TBH I'm spooked enough as it is so going to wipe the server next week, rebuild it and have it behind a physical firewall. I can't find a satisfactory explanation (while ignoring the IIS/FTP references) – Dan Dec 8 '11 at 16:55
  • Event 4624 null sid is the valid event but not the actual user's logon event.
  • The reason for the no network information is it is just local system activity. Windows talking to itself.
  • The "anonymous" logon has been part of Windows domains for a long time--in short, it is the permission that allows other computers to find yours in the Network Neighborhood

Check this article: http://www.morgantechspace.com/2013/10/event-4624-null-sid-repeated-security.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.