Forum

Ultimate Windows Security Forum » Security Log » 627 - Change Password Attempt » Caller of 'NT AUTHORITY\anaonymous logon' or...

Caller of 'NT AUTHORITY\anaonymous logon' or... Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
ronbo
Posted 3/9/2010 4:18:31 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/9/2010 4:15:24 PM
Posts: 3, Visits: 0
I have a number of event 627s where the Caller is 'NT AUTHORITY\anonymous logon' ... What would generate these ???

Also, for 627s where the Caller is a computer, can these safely be ignored as normal system operations ???

Post #322
RandyFranklinSmith
Posted 3/10/2010 5:25:28 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 324, Visits: 0
627s by anonymous are nothing important.  First 627 is where a user is trying to change their own password not an admin setting someone else's password (628).  627, internally are handled by Windows as a logon and that's why you are seeing anonymous.

627s by a computer account are no big deal.  Each computer has it's own account in AD and it regularly has to change its own password like any other user.

Post #323
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:35am