DOCUMENT:Q323909 06-AUG-2002 [winnt] TITLE :ANONYMOUS LOGON Print Jobs Appear in Print Queue PRODUCT :Microsoft Windows NT PROD/VER::4.0,4.0 SP1,4.0 SP2,4.0 SP3,4.0 SP4,4.0 SP5,4.0 SP6,4.0 SP6a OPER/SYS: KEYWORDS:kbenv kbtool kbui ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5, 4.0 SP6, 4.0 SP6a - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5, 4.0 SP6, 4.0 SP6a ------------------------------------------------------------------------------- SYMPTOMS ======== Print jobs that are reported by event ID 10 in the System Event log and banner pages may indicate that they are owned by ANONYMOUS LOGON. Additionally, if the RestrictAnonymous key is set to level 2, and the Everyone group was removed from the permissions of the Spool folder, the spooler stops responding (hangs). Log Entry Example ----------------- Event Type: Information Event Source: Print Event Category: None Event ID: 10 User: NT AUTHORITY\ANONYMOUS LOGON Computer: Description: Document 1, Test - Notepad owned by ANONYMOUS LOGON was printed on HP LaserJet 4Si via port LPT1:. Size in bytes: 818; pages printed: 1 CAUSE ===== The Windows NT 4.0 spooler on the client tried to close the remote printer by using the SYSTEM account instead of impersonating the user who originally opened the printer. The SYSTEM account tried to do this under the following conditions: - When it spooled a GDI print message. - The local spooler was under load. - It was necessary to create another RPC connection to the computer. Under these conditions, a NULL session pipe is created with no credentials. RESOLUTION ========== A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site: http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question. The English version of this fix has the following file attributes (or later): Date Time Version Size File name -------------------------------------------------------- 31 May 2002 17:26 4.0.1381.7165 1,254,608 Win32k.sys 31 May 2002 17:28 4.0.1381.7159 327,440 User32.dll 31 May 2002 17:28 4.0.1381.7102 175,888 Winsrv.dll 31 May 2002 17:28 4.0.1381.7155 169,744 Gdi32.dll WORKAROUND ========== You do not have to use this workaround if the hotfix is installed on all of the clients that are printing to the print server. A client is defined as any computer, including servers and workstations, that sends print jobs to a print server. However, to prevent the spooler from hanging and continue to occasionally print ANONYMOUS LOGON print jobs, you can restore the permissions on the Spool folder, or restore the default setting on the RestrictAnonymous setting to 0 or 1: 1. View the %SystemRoot%\System32\Spool\Printers folder. 2. Add the Everyone group with Full Control rights. STATUS ====== Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. MORE INFORMATION ================ Q143474 Restricting Information Available to Anonymous Logon Users Additional query words: ====================================================================== Keywords : kbenv kbtool kbui Technology : kbWinNTsearch kbWinNTWsearch kbWinNTW400search kbWinNTW400sp5 kbWinNTW400sp3 kbWinNTW400sp1 kbWinNTSsearch kbWinNTS400sp6 kbWinNTS400sp4 kbWinNTS400sp2 kbWinNTS400search kbWinNTW400sp6 kbWinNTW400SP6a kbWinNTW400 kbWinNT400search kbWinNTW400sp4 kbWinNTW400sp2 kbWinNTS400sp5 kbWinNTS400sp3 kbWinNTS400sp1 kbWinNTS400 Version : :4.0,4.0 SP1,4.0 SP2,4.0 SP3,4.0 SP4,4.0 SP5,4.0 SP6,4.0 SP6a Issue type : kbbug Solution Type : kbfix ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2002.