, August 06, 2003 3:27 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] Anonymous Logon
I would not have been surprised to see this on a web server, but the domain
controllers being audited do not have either www or ftp services running. I
was not prepared for the voluminous amount of system
Can vouch for the Kiwi server. Works great, and even better its free.
G.
- Original Message -
From: Free, Bob [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, August 07, 2003 6:49 AM
Subject: RE: [ActiveDir] Anonymous Logon
Since I'll need a syslog server, I'd like one
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rittenhouse, Cindy
Sent: Monday, August 04, 2003 1:35 PM
To: '[EMAIL PROTECTED]'
Subject: [ActiveDir] Anonymous Logon
I successfully upgraded my NT domain to AD yesterday. I now find my DC
security log on the PDC
] On Behalf Of rick reynolds
Sent: Wednesday, August 06, 2003 10:10 AM
To: [EMAIL PROTECTED]
Subject: Re: [ActiveDir] Anonymous Logon
If web services or ftp are running on those, both those services allow
anon to access the main page,
- Original Message -
From: Rittenhouse, Cindy [EMAIL PROTECTED
: Thursday, August 07, 2003 6:14 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] Anonymous Logon
How are you sending the Windows event logs to a syslog server? Is that
Kiwi
as well?
--
Roger D. Seielstad - MTS MCSE MS-MVP
Sr. Systems
Title: RE: [ActiveDir] Anonymous Logon
Then again you know Rick Kingslan has wonderful AD knowledge !!!
Carlos Magalhaes ADSI MVP
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 06, 2003 3:02 PM
To: ActiveDir
Subject: Re: [ActiveDir
If web services or ftp are running on those, both those services allow anon
to access the main page,
- Original Message -
From: Rittenhouse, Cindy [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, August 05, 2003 1:02 PM
Subject: RE: [ActiveDir] Anonymous Logon
Rick
Great post
--
Sent from my BlackBerry Wireless Handheld
- Original Message -
From: ActiveDir-owner
Sent: 08/05/2003 11:03 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] Anonymous Logon
Cindy,
If you're going to have to keep all audit entries, you're going
: [ActiveDir] Anonymous Logon
Rick,
The security logs in question are on my Windows 2000 domain controllers,
PSDC1 and PSDC2. When I Audit Logon Events, the log fills with Event 538 NT
Authority\Anonymous Logon User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Return Receipt
Your RE: [ActiveDir] Anonymous Logon
document
: Re: [ActiveDir] Anonymous Logon
If web services or ftp are running on those, both those services allow anon
to access the main page,
- Original Message -
From: Rittenhouse, Cindy [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, August 05, 2003 1:02 PM
Subject: RE: [ActiveDir
Thanks to all for the references and responses. I think I'm on the right
path, I've ordered the MonitorWare.
-Original Message-
From: Rick Kingslan [mailto:[EMAIL PROTECTED]
Sent: Friday, August 08, 2003 00:22
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] Anonymous Logon
Nope
, August 06, 2003 3:11 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] Anonymous Logon
Does anyone have any experience with MonitorWare. Since I'll need a syslog
server, I'd like one that will also work with the logs on our Cisco devices?
-Original Message-
From: Rick Kingslan [mailto
Return Receipt
Your RE: [ActiveDir] Anonymous Logon
document
: [ActiveDir] Anonymous Logon
Cindy,
If you're going to have to keep all audit entries, you're going to have a
tough time. I can help decipher these records for you (I do a lot of
this!), but in a nutshell you've recorded a successful logoff (the Event
538) and a successful network logon via
I successfully upgraded my NT domain to AD yesterday. I now find my DC
security log on the PDC emulator filling up twice a day. It is set to 2048
KB, do not overwrite (I have to save them for 3 years). The majority of
events are Anonymous logons. Is it normal to have this quantity of Anonymous
16 matches
Mail list logo
