MonitorWare Knowledge Base

i have a bad feeling about the following, but I have to confirm with the Guru's out there.

I have recently taken a network over from another sysad and I was cleaning the Domain controller (win2k) out.

I noticed a profile in C:\Documents and Setting\NT AUTHORITY\ANONYMOUS LOGON

Normally that means a login...

Am I right, has the system been compromised?

ok so you found some anonymous login. Whats the next logical step. Find out who and from which machine.

How to get the source IP ?