Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i found this in my event log not sure if im

the source seems potentially dangerous

The service control manager (SCM) is started at system boot. It is a remote procedure call (RPC) server, so that service configuration and service control programs can manipulate services on remote machines.

i looked in the security event log and i cant find any correlation with the login id

            1201 - Time                     : 11/19/2012 11:02:52 PM
            1202 - Source                   : Service Control Manager
            1203 - Description              : An account was logged off.

                                                Security ID:        S-1-5-7
                                                Account Name:       ANONYMOUS LOGON
                                                Account Domain:     NT AUTHORITY
                                                Logon ID:       0x13e82ef

                                              Logon Type:           3
share|improve this question

The "Source" is what's reporting the event to the event log, not necessarily the cause.

S-1-5-7 is the security ID of an "Anonymous" user, not the Event ID.

Based on the Logon Type (3), it looks like (allowed) anonymous access to a network resource on your computer (like a shared folder, printer, etc.). So no-one is hacking, they are simply using a resource that is allowed to be used by users without logging on with a username/password (AKA: Anonymous).

Find the matching Logon event (probably Event ID 4624) and it's details should tell you where they're logging on from (IP address).

More info on Logon types here.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .