Event ID 537

[Matt Vaughan]

On my domain controllers I'm getting a event ID 537, failure audit. When
viewing the details, it does not have a username -- it's blank. It also
does have a workstation name. It seems as if some service is attempting to
logon to the network, but I have not been able to pinpoint the source of the
failure. How can I track this down?

Here's a sample of the event:
Logon Failure:

Reason: An unexpected error occurred during logon

User Name:

Domain:

Logon Type: 3

Logon Process: Kerberos

Authentication Package: Kerberos

Workstation Name: -

 

[Diana Smith [MSFT]]

Hi Matt,

Take a look at the article listed below:
318922 Event 537 Is Listed in the Security Event Log
http://support.microsoft.com/?id=318922

If you wanted to track it, you could enable netlogon logging:
109626 Enabling Debug Logging for the Net Logon Service
http://support.microsoft.com/?id=109626

Thank You.

Diana.

This posting is provided "AS IS" with no warranties, and confers no rights.