Re: Since W2003 SP1, many event 537 (failed logon)

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff

Using your IE put the link below (copy\paste) in the address bar and hit
enter. You will be taken to the proper newsgroup that will be able to help
you. Since you are using the CDO interface you can access that group as I
said above

news://microsoft.com/microsoft.public.windows.server.general


--
Peter

Please reply to Newsgroup for the benefit of others.

"JoesCat" <JoesCat@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:76528430-2CEC-44B4-BBD9-A99817767C96@xxxxxxxxxxxxxxxx
> This is a resource 2003 server, only hosting SUS, Backup software,
> anti-spyware software, etc. No one typically uses it for file/printer
> sharing and the like, so they don't log onto its resources.
> We're not running Active Directory (yet).
>
> I have not found anything searching the MS knowledgebase.
>
> Anyway, I'm getting repeated:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 537
> Date: 4/18/2005
> Time: 9:02:40 AM
> User: NT AUTHORITY\SYSTEM
> Computer: XXXXXX
> Description:
> Logon Failure:
> Reason: An error occurred during logon
> User Name:
> Domain:
> Logon Type: 3
> Logon Process: Authz
> Authentication Package: Kerberos
> Workstation Name: XXXXXX
> Status code: 0xC000005E
> Substatus code: 0x0
> Caller User Name: {machinename$}
> Caller Domain: XXXXXX
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 1004
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>


.

Relevant Pages

  • Re: please help to extract security event log
    ... I want to select security events of " logon/logoff" category between say ... Successful Network Logon: ... Caller User Name: - ...
    (microsoft.public.scripting.vbscript)
  • Re: Many Logon/Logoff Entries
    ... last week-end troubleshooting a Logon/LogOff issue and discovered just how ... over 170,000 of these entries in the Security Log. ... > Logon ID: ... > Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Security event crazyness... help!
    ... 540/538 as teh even type here is even log entries, ... Event Category: Logon/Logoff ... Successful Network Logon: ... Caller User Name: - ...
    (microsoft.public.windows.server.general)
  • too many logon/logoff events in security log
    ... I turn on the audit policy to monitor the logon/logoff envents in security ... However, there is too many logon/logoff events, average 3 times per ... Logon ID: ... Caller User Name: - ...
    (microsoft.public.windows.server.security)
  • Re: KDC Event ID 7 and Wins startup errors.
    ... Event Type: Information ... Event Source: USER32 ... Logon Failure: ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)