Windows – How to tell what time a domain user logged in

The "anonymous" logon has been part of Windows domains for a long time--in short, it is the permission that allows other computers to find yours in the Network Neighborhood, find what file shares or printers you are sharing, etc.

It is also why Windows admins say never to grant share permissions to the "Everyone" group (unless you know what you are doing), because "Everyone" also includes "no one"--er, ANONYMOUS. Rest assured that unless you

Anyway, in this case you probably want to lock it down with Registy settings or better yet, Local or Group Policies. Look in your policy editor under Computer Configuration\Windows Settings\SecuritySettings\Local Policies\SecurityOptions for the following options:

• Network access: Allow anonymous SID/Name translation
• Network access: Do not allow anonymous enumeration of SAM accounts
• Network access: Do not allow anonymous enumeration of SAM accounts and shares
• Network access: Let Everyone permissions apply to anonymous users
• Network access: Named Pipes that can be accessed anonymously
• Network access: Shares that can be accessed anonymously

Sure. You can do that.

Create the "generic" account and give it permission to whatever you need to. Set a password for the account and use Group Policy to make the autologon happen.

There isn't a stock Group Policy template to control autologon. A simple template would be something like:

CLASS MACHINE 

CATEGORY "System"
    CATEGORY "Logon"
        POLICY "Auto Logon"
            KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 
            VALUENAME "AutoAdminLogon" 
            VALUEON "1" 
            VALUEOFF "0"

            PART "Username" EDITTEXT 
                VALUENAME "DefaultUserName" 
            END PART 

            PART "Domain" EDITTEXT 
                VALUENAME "DefaultDomainName" 
            END PART 

            PART "Password" EDITTEXT 
                VALUENAME "DefaultPassword" 
            END PART
        END POLICY
    END CATEGORY ; "Logon"
END CATEGORY ; "System"

Save that in an ".ADM" file, create your OU and GPO linked to it, and edit the GPO. In the Group Policy editor you'll need to right-click "Administrative Templates" and "Add/Remove Templates" to add this template. You'll find these settings under "Classic Administrative Templates".

Bear in mind that this setting will "tattoo" the registry of the PCs you apply it to. When you move them out of the OU they'll retain the autologon settings. Either remove them via script or relocate the PCs to an an OU with an "evil anti-policy" GPO linked that has the autologon setting disabled to un-tattoo them.

If you want some specific Group Policy settings to apply to the generic user account be sure you put that user object in the proper location and give it the proper group memberships, etc.