Re: Event ID 537

Hi Marina,


Thanks for your input. I have run all the commands you suggested in your post, and also checked for any stored passwords (none found), but the error remains.

What I did find which was interesting, is that if I log into the "problem" workstation using my logon credentials, the error appears only once (well three times, all at exactly the same time down to the second), but never occurs again, compared to when the user "Beverley" is logged in where the error generates every 30 seconds (again, three times per 30 second interval).

We have gone as far as comparing processes running under each of the two users, but they also compare right down to the last one, 37 processes in all.

We are now thinking that maybe we should break the computer from the domain, and rejoin under the "problem" user account, what would you suggest?


Kind regards,


Andrew




"Marina Roos [SBS-MVP]" <marina@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:OStV1XEiGHA.3408@xxxxxxxxxxxxxxxxxxxxxxx
Hi Andrew,

Nice meeting you again ;-)

First off, please run the following on the client from the command prompt (just once):

net time /setsntp:servername (sbs server that is)
w32tm /resync
gpupdate/force

Than in Control Panel, Stored Passwords, check if there is any entry. If there is, delete it.
Are there any services on that client using an account that might not be known to the SBS?


--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

"Andrew Gericke" <amgerick@xxxxxxxxxx> schreef in bericht news:eEdSNCBiGHA.2188@xxxxxxxxxxxxxxxxxxxxxxx


The reaosn for having to try fix the problem is simply that it is filling up my event logs with non-essential entries. 3000 entries a day.


"Cris Hanna (SBS-MVP)" <crisnospamhanna@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:%23gFlmvAiGHA.1272@xxxxxxxxxxxxxxxxxxxxxxx
I understand the desire to be error free, but you'll have to decide if the time is worth it since there are no functional issues.
Perhaps Marina will have some thoughts on this.

Have you already been through this list?
http://www.eventid.net/display.asp?eventid=537&eventno=194&source=Security&phase=1


--
Cris Hanna [SBS-MVP]
--------------------------------------
Please do not respond directly to me, but only post in the newsgroup so all can take advantage
"Andrew Gericke" <amgerick@xxxxxxxxxx> wrote in message news:u02UWkAiGHA.1320@xxxxxxxxxxxxxxxxxxxxxxx
None what so ever.
"Cris Hanna (SBS-MVP)" <crisnospamhanna@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:u8Urs%23$hGHA.3496@xxxxxxxxxxxxxxxxxxxxxxx
So what issues is the workstation having functionally (other than throwing this error in the event log)

--
Cris Hanna [SBS-MVP]
--------------------------------------
Please do not respond directly to me, but only post in the newsgroup so all can take advantage
"Andrew Gericke" <amgerick@xxxxxxxxxx> wrote in message news:O7$6O09hGHA.3572@xxxxxxxxxxxxxxxxxxxxxxx
Hi there, yes we did. We did have a problem with OWA and OMA afterwards, and Marina Roos provided remote support and fixed that as well as gave our server a once over (fantastic service), so I am pretty confident the SBS SP1 install is ok. Just strange though that this error started after loading SP1, but only on the one workstation when all workstations run the same OS and SP's.


"Cris Hanna (SBS-MVP)" <crisnospamhanna@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:%23CY90w9hGHA.4864@xxxxxxxxxxxxxxxxxxxxxxx
Did you install SP1 from the SBS SP1 CD?

--
Cris Hanna [SBS-MVP]
--------------------------------------
Please do not respond directly to me, but only post in the newsgroup so all can take advantage
"Andrew Gericke" <amgerick@xxxxxxxxxx> wrote in message news:%23Z2U527hGHA.2208@xxxxxxxxxxxxxxxxxxxxxxx
XP Professional, SP2. Nothing on workstation has changed, although I have recently applied SP1 for the SBS2003 server.



"Cris Hanna (SBS-MVP)" <crisnospamhanna@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:OZ9JWo3hGHA.1264@xxxxxxxxxxxxxxxxxxxxxxx
what is the OS of the workstation??

--
Cris Hanna [SBS-MVP]
--------------------------------------
Please do not respond directly to me, but only post in the newsgroup so all can take advantage
"Andrew Gericke" <amgerick@xxxxxxxxxx> wrote in message news:%23SLCjS1hGHA.4044@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

One of my workstations on my SBS2003 network has just recently started
generating Event ID 537 errors to the servers security log. It logs the
error 3 times every 30 seconds, which means that in the typical working day
I have around 2000-3000 errors in my event log. I have searched for a
solution to this error, but it seems that it could be as a result of many
reasons. The mosty likely one seemed to be that the workstations time was
out of sync with the servers, but I have checked and even reset the time
sync with the server, to no avail.

Further detail of the error is as follows:

Logon Failure:
Reason: An error occurred during logon
User Name: Beverley
Domain: AGCACC
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC00002EE
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -



If anyone has any advice for me, I would really appreciate it.


Thanks


Andrew

Relevant Pages

  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: DCOM Errors in Event log
    ... A time difference between the workstation and the server do you? ... An error occurred during logon ... Les Connor [SBS Community Member - SBS MVP] ... on the server in the security log we are getting error 537 in the event log. ...
    (microsoft.public.windows.server.sbs)
  • Re: Server is working but unable to logon by any means
    ... SideBySide errors in event log. ... the server in the same state as it was yesterday. ... Safe Mode is not working - same issue it will not display logon ...
    (microsoft.public.windows.server.general)
  • Re: Upgrade from W2K Server to Server 2003 "gotchas"...
    ... > Server because you can't simply upgrade!??! ... I go to the first workstation and try to ... I did the registry edit and pointed the logon to the old user ... > logon to my local machine accounts but not ...
    (microsoft.public.windows.server.networking)