Question : Sucess Audit event id 540

In our event log we have many of the following:
Event Type:      Success Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      540
Date:            10/21/2009
Time:            11:42:02 AM
User:            NT AUTHORITY\ANONYMOUS LOGON
Computer:      OURSchool
Description:
Successful Network Logon:
       User Name:      
       Domain:            
       Logon ID:            (0x0,0xCD42556)
       Logon Type:      3
       Logon Process:      NtLmSsp
       Authentication Package:      NTLM
       Workstation Name:      OLEK
       Logon GUID:      -
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID: -
       Transited Services: -
       Source Network Address:      82.177.119.87
       Source Port:      0

I want to make sure we are OK and can ignore this. Thanks,

Answer : Sucess Audit event id 540

In the IIS console, right-click on your website and go to the Properties tab.  Typically, you'll see a Web Site tab with an option for 'Enable Logging'.  If not checked, then logging is not currently enabled for the website.  You'll want to enable it so future events are recorded.

If it is checked, click the 'Properties' button for the location of the log files which I stored typically in log files per day.

Regardless, I would suggest blocking the source IP from your firewall - unless the traffic is still occurring and you want to see what they are doing.

Mike