An Error Occurred During Logon Kerberos 537
Contents |
(עברית)المملكة العربية السعودية (العربية)ไทย (ไทย)대한민국 (한국어)中华人民共和国 (中文)台灣 (中文)日本 (日本語) HomeWindows Server 2012Windows Server 2008 R2Windows Server 2003LibraryForums Ask a question an error occurred during logon 0xc00006d exchange Quick access Forums home Browse forums users FAQ
An Error Occurred During Logon 0xc00002ee
Search related threads Remove From My Forums Answered by: Event ID: 537 an error occurred during logon 4625 logged repeatedly by one workstation Windows Server > Windows Server General Forum Question 0 Sign in to vote We an error occurred during logon 0xc00006d substatus 0x0 have a problem with only one of the eight workstations in our domain; it generates many 537 (60 - 80 per day) and a few 673 security failures each day. The events are logged at all hours, often at night
An Error Occurred During Logon 0xc00005e
and early morning. Some of these are copied below. I can find no useful information about these in the Microsoft Knowledge base. Can anyone shed some light on this problem? Thanks! David ------------------------------ Event Type: Failure AuditEvent Source: SecurityEvent Category: Account Logon Event ID: 673Date: 7/9/2009Time: 12:53:33 AMUser: NT AUTHORITY\SYSTEMComputer: SBSERVERDescription:Service Ticket Request: User Name: User Domain: Service Name: Service ID: - Ticket Options: 0x40800000 Ticket Encryption Type: - Client Address: 192.168.1.75 Failure Code: 0x25 Logon GUID: - Transited Services: - For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ------------------------------ Event Type: Failure AuditEvent Source: SecurityEvent Category: Logon/Logoff Event ID: 537Date: 7/9/2009Time: 12:53:33 AMUser: NT AUTHORITY\SYSTEMComputer: SBSERVERDescription:Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC000006D Substatus code: 0xC0000133 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 192.168.1.75 Source Port: 4909 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ------------------------------ Event Type: Failure AuditEvent Source: SecurityEvent Category: Logon/Logoff Event ID:
name 537: Logon failure - The logon attempt failed for other reasons. On this page Description of this event Field level details Examples Discuss this event Mini-seminars on this event an error occurred during logon null sid Thanks toIsaac at Prism Microsystems (EventTracker) for this explanation: Event ID 537 is a an error occurred during logon 0xc00006d ntlmssp generic logon failure that most of the time that I've seen it has a blank user name, to figure out what
An Error Occurred During Logon 0xc00006d Sub Status 0x0
the true underlying cause of the logon failure you need to look at the Status Code and Substatus Code in the description. The codes that I see most often when talking to customers is: https://social.technet.microsoft.com/Forums/windowsserver/en-US/2df4c103-f01a-40c2-978d-39bea6b53a31/event-id-537-logged-repeatedly-by-one-workstation?forum=winservergen Status code: 0xC000006D Substatus code: 0xC0000133 These 2 codes indicate that the workstation clock is more than 5 mins out of sync with the Domain Controller. I have put together a blog entry on how to analyze event 537. Here's a link to the status codes at MSDN Free Security Log Quick Reference Chart Description Fields in 537 User Name: Domain: Logon Type: Logon Process: Authentication Package: Workstation https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=537 Name: The following fields are added in Windows Server 2003: Caller User Name: Caller Domain: Caller Logon ID: Caller Process ID: Transited Services: Source Network Address: Source Port: Top 10 Windows Security Events to Monitor Examples of 537 Event Type: Failure Audit Event Source: Security Event ID:537 User:NT AUTHORITY\SYSTEM Computer: DC1 Description: Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package:Kerberos Workstation Name: - Status code: 0xC000006D Substatus code:0xC0000133 Caller User Name:- Caller Domain: - Caller Logon ID: - Caller Process ID:- Transited Services: - Source Network Address:192.168.1.144 Source Port: 0 Keep me up-to-date on the Windows Security Log. Email*: Bad email address *We will NOT share this Mini-Seminars Covering Event ID 537 Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs Discussions on Event ID 537 • Event : 537 - Blank user name Upcoming Webinars Leveraging SCCM to Manage the Security of Your Endpoints Additional Resources Security Log Quick Reference ChartThe Leftovers: A Data Recovery Study Encyclopedia •All Event IDs•Audit Policy Go To Event ID: Must be a 2-5 digit number No such event ID Security Log Quick Reference Chart Download now! Tweet Home > Security Log > Enc
Answer Questions My Profile ShortcutsDiscussion GroupsFeature RequestsHelp and SupportHow-tosIT Service ProvidersMy QuestionsApp CenterRatings and ReviewsRecent ActivityRecent PostsScript CenterSpiceListsSpiceworks BlogVendor PagesWindows Events Event 537 (Failure Audit) Source: Security How important is https://community.spiceworks.com/windows_event/show/299-security-537 this event? (7 votes) 1 2 3 4 5 not important very important Description This problem occurs because Winlogon.exe incorrectly tries a cached logon process for the user who is logging on to the https://www.experts-exchange.com/questions/23763709/How-do-I-resolve-event-ID-537-from-the-Critical-Errors-Security-Log-An-error-occured-during-logon-from-occurring.html local computer. http://support.microsoft.com/kb/327889 This problem occurs because Winlogon.exe incorrectly tries a cached logon process for the user who is logging on to the local computer. http://support.microsoft.com/kb/327889 Add link Text to display: Where should this an error link go? Add Cancel × Insert code Language Apache AppleScript Awk BASH Batchfile C C++ C# CSS ERB HTML Java JavaScript Lua ObjectiveC PHP Perl Text Powershell Python R Ruby Sass Scala SQL VB.net Vimscript XML YAML Insert Cancel Save Cancel Associated Messages Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: an error occurred 0xC000006D Substatus code: 0xC0000133 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 10.0.20.184 Source Port: 4875
Sep 18, 2009 Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC000006D Substatus code: 0xC0000133 Sep 30, 2009 Logon Failure: Reason: An error occurred during logon User Name: AAIP074$ Domain: ARIUM.COM Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC00000DC Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 65.169.214.74 Source Port: 0 Mar 01, 2010 Logon Failure: Reason: An unexpected error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Mar 19, 2010 Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC000005F Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source PHelp Receive Real-Time Help Create a Freelance Project Hire for a Full Time Job Ways to Get Help Ask a Question Ask for Help Receive Real-Time Help Create a Freelance Project Hire for a Full Time Job Ways to Get Help Expand Search Submit Close Search Login Join Today Products BackProducts Gigs Live Careers Vendor Services Groups Website Testing Store Headlines Experts Exchange > Questions > How do I resolve event ID 537 from the Critical Errors Security Log "An error occured during logon" from occurring? Want to Advertise Here? Solved How do I resolve event ID 537 from the Critical Errors Security Log "An error occured during logon" from occurring? Posted on 2008-09-25 SBS 4 Verified Solutions 63 Comments 2,910 Views Last Modified: 2008-11-05 When I get an error report I get both but sometimes I get only one of the two. Everyday it is a different scenario. There are days when I get no error messages,once in a blue moon that is. How do I resolve this dilemma? For the last couple of months i have bee getting on my Server Performance Report the following error in section Critical errors i security log: Critical Errors in Security Log Source Event ID Last Occurrence Total Occurrences Security 537 9/24/2008 10:06 PM 27 * Logon Failure: Reason: An error occurred during logon User Name: username Domain: domain_name Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC00002EE Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - -------------------------------------------------- Source Event ID Last Occurrence Total Occurrences Security 529 9/24/2008 4:14 PM 6 * Logon Failure: Reason: Unknown user name or bad password User Name: McAfeeMVSUser Domain: other_domain_name Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: same_as_other_doamin_name Caller User Name: - Caller Domain: - Caller