Error Occurred During Logon 0xc00002ee
Contents |
(עברית)المملكة العربية السعودية (العربية)ไทย (ไทย)대한민국 (한국어)中华人民共和国 (中文)台灣 (中文)日本 (日本語) HomeWindows 10Windows 10 MobilePrevious versionsMDOPSurfaceSurface HubLibraryForums Ask a question Quick access Forums home Browse forums users FAQ Search related threads Remove From My Forums Answered by: Troubleshooting Event ID 4625 on Windows 2008 dcom error interface not supported R2 domain controller Windows Server > Security Question 0 Sign in to vote 0xc00002ee logon failure I am trying to troubleshoot a logon failure we are receiving (DC running Windows 2008 R2). This weekend
An Error Occurred During Logon 0xc00006d Exchange
we started getting the following message: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 09/23/2010 11:16:06 AM Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer: mydomaincontroller.domain.com Description:
An Error Occurred During Logon 4625
An account failed to log on. Subject: Security ID:NULL SID Account Name:- Account Domain:- Logon ID:0x0 Logon Type:3 Account For Which Logon Failed: Security ID:NULL SID Account Name:JohnDoe Account Domain:HLC Failure Information: Failure Reason:An Error occured during Logon. Status:0xc00002ee Sub Status:0x0 Process Information: Caller Process ID:0x0 Caller Process Name:- Network Information: Workstation Name:- Source Network Address:- Source Port:- Detailed Authentication Information: an error occurred during logon 0xc00006d substatus 0x0 Logon Process:Kerberos Authentication Package:Kerberos Transited Services:- Package Name (NTLM only):- Key Length:0 I've tried capturing packets with Wireshark to see if I can see what's generating the traffic but haven't had any luck. Based on the fact that the "Network Information" is blank I'm thinking that this is some local process on the server that's causing the issue. I've looked at services but the user is only on a couple of services and they're running fine. Thursday, September 23, 2010 6:13 PM Reply | Quote Answers 0 Sign in to vote Sorry I haven't replied on this issue as I was out of the office last week. The account name on all events is the same. It was happening every couple of minutes. We tried restarting the services (and even disabled them for a period) to see if the service was generating the messages. We found that with the service disabled the messages still happened. We have this same user specified as a user on services on all of our servers and this one was the only one reporting the error. After lo
Gaming Smartphones Tablets Windows 8 PSUs Android Your question Get the answer Tom's Hardware>Forum>Windows 2000/NT>Logon failure with status
An Error Occurred During Logon 0xc00005e
code 0xC00002EE> Logon failure with status code 0xC00002EE Tags: Security an error occurred during logon null sid Microsoft Windows Last response: 1 December 2004 12:57 in Windows 2000/NT Share tomas 1 December 2004 an error occurred during logon 537 11:53:03 Archived from groups: microsoft.public.win2000.security (More info?) I found 20 Failure audit (Source: Security, EventID: 537) events within 1 minute Logon Failure: Reason: An error https://social.technet.microsoft.com/Forums/windows/en-US/d32a71a5-1c77-4040-93dd-b433cbf14a45/troubleshooting-event-id-4625-on-windows-2008-r2-domain-controller?forum=winserversecurity occurred during logon User Name: tomas Domain: JT Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC00002EE Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - http://www.tomshardware.com/forum/224457-46-logon-failure-status-code-0xc00002ee What does Logon Type 3 mean (is it interactive logon, network logon or etc.)? And what does status code 0xC00002EE mean? More about : logon failure status code 0xc00002ee tomas 1 December 2004 12:57:02 Archived from groups: microsoft.public.win2000.security (More info?) I found in ntstatus.h file this: <...> // MessageId: STATUS_UNFINISHED_CONTEXT_DELETED // // MessageText: // // A security context was deleted before the context was completed. This is considered a logon failure. // #define STATUS_UNFINISHED_CONTEXT_DELETED ((NTSTATUS)0xC00002EEL) <...> Is this what I'm looking for? If its is, then how can I now what context was deleted and should I be worried about it? Can't find your answer ? Ask ! Publish Related resources Get harddisc failure code ,failure time stamp and harddisc status Forum SolvedSupermicro Status Code LED shows Code 73 - only just noticed it. Forum SolvedWD 2TB internal HHD "read element failure status 7" Forum Solvedwindows 7 logon failure Forum XP P
Guest Hi, I keep getting this particular error from every performance report in the morning, should I be concerned? http://www.winvistatips.com/threads/logon-errors-from-server-performance-report.627696/ Your help is much appreciated. Source: Security Event ID: 537 Last Occurrence: Jan 23, 2006 at 5:45 AM Total Occurrences: 570 Logon Failure: Reason: An error occurred during logon http://forums.isaserver.org/m_2002099593/tm.htm User Name: Administrator Domain: DOMAIN Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC00002EE Substatus code: 0x0 Caller User Name: - Caller Domain: error occurred - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - Newbie, Jan 23, 2006 #1 Advertisements Kevin Weilbacher [SBS-MVP] Guest Make sure that your workstations are properly time synced to your server. http://msmvps.com/blogs/bradley/archive/2004/01/22/1995.aspx -- Kevin Weilbacher [SBS-MVP] "The days pass by so quickly now, the nights are error occurred during seldom long" "Newbie" <> wrote in message news:... > Hi, > > I keep getting this particular error from every performance report in the > morning, should I be concerned? > > Your help is much appreciated. > > > Source: Security > Event ID: 537 > Last Occurrence: Jan 23, 2006 at 5:45 AM > Total Occurrences: 570 > > > Logon Failure: > Reason: An error occurred during logon > User Name: Administrator > Domain: DOMAIN > Logon Type: 3 > Logon Process: Kerberos > Authentication Package: Kerberos > Workstation Name: - > Status code: 0xC00002EE > Substatus code: 0x0 > Caller User Name: - > Caller Domain: - > Caller Logon ID: - > Caller Process ID: - > Transited Services: - > Source Network Address: - > Source Port: - > > Kevin Weilbacher [SBS-MVP], Jan 24, 2006 #2 Advertisements Newbie Guest Hi Kevin, I'll check all the workstations but I thought they were sync'ing the time against the SBS server okay. Thanks. "Kevin Weilbacher [SBS-MVP
| Address Book | Member List | Search | FAQ | Ticket List | Log Out Failure Audits in Security Event Log of ISA Server Users viewing this topic: none Logged in as: Guest Tree Style Printable Version All Forums >> [ISA Server 2004 General ] >> General >> Failure Audits in Security Event Log of ISA Server Page: [1] Login Message << Older Topic Newer Topic >> Failure Audits in Security Event Log of ISA Server - 30.Mar.2010 1:52:25 PM sdegroft Posts: 2 Joined: 30.Mar.2010 Status: offline We are getting two regular Failure Audits with event ID 537 in our Security log on our ISA Server every 2 minutes and one second. Here is the text of the Failure Audit. They are all identical: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 537 Date: 03/30/2010 Time: 9:18:48 AM User: NT AUTHORITY\SYSTEM Computer: ISAServerName Description: Logon Failure: Reason: An error occurred during logon User Name: DomainAdminAccount Domain: DomainName Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: - Status code: 0xC00002EE Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - I captured packets on the ISA Server and found the following packet descriptions occurring every time the Failure audits occurred. 1 0.000000 X.X.X.66 X.X.X.65 TCP odi-port > epmap [PSH, ACK] Seq=1 Ack=1 Win=65535 Len=48 2 0.001008 X.X.X.65 X.X.X.66 DCERPC Bind_ack: call_id: 1 Unknown result (3), reason: Abstract syntax not supported 3 0.001331 X.X.X.66 X.X.X.65 DCERPC Alter_context: call_id: 1 IOXIDResolver V0.0 4 0.003280 X.X.X.66 X.X.X.65 TCP brcm-comm-port > epmap [PSH, ACK] Seq=1 Ack=1 Win=65535 Len=48 5 0.004219 X.X.X.65 X.X.X.66 DCERPC Bind_ack: call_id: 1 Unknown result (3), reason: Abstract syntax not supported 6 0.004464 X.X.X.66 X.X.X.65 DCERPC Alter_context: call_id: 1 IOXIDResolver V0.0 The first part (odi-port and brcm-comm-port) changes every time. Any ideas why X.X.X.66(Print Server) is trying to connect to X.X.X.65(ISA Server) every two minutes and one second and is failing to do so? What function does IOXIDResolver