MonitorWare Knowledge Base

we are seeing event id 540 under security logs of few
workstations. the user that genrated the id is someone
else then the workstation owner. So mgmt trying to figure
out what does it mean. does it mean the user tried to
access this workstation remotly.
can someone explain?
thanks

540 is a network logon, it means someone/something accessed the computer
over the network. Absolutely normal to see these for "Anonymous".
Otherwise, could be file sharing, printer sharing, etc.

Why is it normal to see from "Anonymous"?

Also, if it from someone else, does it mean someone logged
on to his machine. if so that would be security issue.?

Alan,

these are null sessions. See here:

http://www.monitorware.com/en/events/de ... ails_id=14

HTH
Rainer