Dear Forumers, I apologize if the question had been asked before, but I have in my event viewer thousands of line; all of them with the Event ID 540. I would like to know if this event has any risk on the remote server and if then, what shall I do to check or to know the action behind this connection/event. In other words, when is this event generated Many thanks for your answer Sincerely CNS-Dir

This might help http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/6d95e56a-dd0e-406e-b492-faa6e37fabee MCSE | MCITP - Server 2008, Exchange 2007, Exchange 2010

Hi, Kindly post the entire event, it's hard to comment just on event id.Gulab | MCITP: Exchange 2010-2007 | Skype: Gulab.Mallah | Blog: www.ExchangeRanger.Blogspot.com

Hi CNS-Dir, First of all, I’d like to explain that it is common to see these anonymous logon/logoff events on computers using Windows networking and that have file and print sharing and Client for Microsoft networks as well as the browser service enabled. Anonymous logon means that it is a null session. NT Auth/Anonymous is just a pseudonym for a Null Session. User connections should never come in under NT Auth/Anonymous since this isn't really an account; it just means that no credentials were supplied. The following conditions are known to cause null session connections: 1. The browser service that maintains a list of the domain name or workgroup name the computer is in. Since it is working between domains and workgroups, it has to use anonymous network communication. 2. The Server Service registers an Anonymous logon after service startup every time. A password change from a down level client after a password has expired will also cause this. Best Regards!Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.