NT AUTHORITY\ANONYMOUS LOGON in bluecoat

Problem Description

You see the NT AUTHORITY\ANONYMOUS LOGON username in the access logs

You see NT AUTHORITY\ANONYMOUS LOGON in the policy trace

Resolution

BCAAA reports the anonymous user when it finds a NULL SMB session. This is the correct behavior, because NULL sessions use anonymous credentials.

This problem can be fixed by adding to the [SSOServiceUsers] section of sso.ini. This will cause BCAAA to ignore NULL sessions. BCAAA must be restarted after applying the changes.
 

From:
[SSOServiceUsers]
; Standared Windows service users
NetShowServices

To:
[SSOServiceUsers]
; Standared Windows service users
NetShowServices
NT AUTHORITY\ANONYMOUS LOGON

Bluecoat ขึ้น user เป็น NT AUTHORITY\ANONYMOUS LOGON

เกิดจาก agent BCAAA ของ bluecoat สามารถปรับแก้ได้โดยแก้ไข sso.ini อยู่ใน Folder ของ BCAAA ที่ program file

https://kb.bluecoat.com/index?page=content&id=KB3813