Change Auditor displays "BUILTIN\BUILTIN" instead of "ANONYMOUS" for NTLM v1 events under User.
The corresponding Windows Server Security Log records the event as "ANONYMOUS".
Investigation shows that the SamAnalyzer::CheckNtlmLogon method on non-DC hosts, and the ADAnalyzer::CheckNtlmOrKerberos method on DC hosts, rely on the ATL CSid class to convert incoming domain and account names to a SID. However, the incoming domain and account from the hook are empty strings when the caller is NT AUTHORITY\ANONYMOUS LOGON (confirmed using Windows Security Event Log 4624) and for those CSid constructor returns a SID for "BUILTIN".
A defect was logged to fix this in a future version or hotfix.
Defect ID: 606541 Logon NTLM v1 events show user as BUILTIN\BUILTIN
There is no ETA yet, forecast for CA 7.7
