Failure Audit 537 in Event Log

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Got a couple of SBS 2003 Premium servers (patched to SP2) which have
started getting the following entries in their Security Event Logs
recently:

---------------

Type: Failure Audit
Event ID: 537
User: NT AUTHORITY\SYSTEM
Computer: SBS

Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: ÐùSü ‚|
Authentication Package: NTLM
Workstation Name:
Status code: 0x80090308
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

---------------

The characters under 'Logon Process' change with every entry but
everything else is the same. The only change that's occurred recently
on both servers is that they've been upgraded From Trend CSM 3.6 to
WFBS Advanced 5.0 & are both running the OfficeScan site under IIS
with SSL turned off (port 4343) following the instructions on the
Trend Website to avoid a conflict with ISA 2004.

Any ideas?

Jonathan
.