EventID 534: User has not been granted requested logon type

[Will]

In general I'm familiar with Event ID 534, which is a Security Eventviewer
log message that indicates that "the user has not been granted the requested
logon type at this machine". What is confusing me is that I frequently
see these eventids with a logon type of 3 (network logon) where the username
and domain are *blank*. Workstation name is also blank. I thought
that this might be an anonymous logon request, but what is all the more
perplexing is that the logon process is Kerberos.

What are the possible sources of such a request?

 

[Steven L Umbach]

There was a problem with this on XP Pro computers if that is where you are
seeing them as shown in the link below. --- Steve

http://support.microsoft.com/?kbid=841399

 

[Will]

I see these messages on Windows 2000 Server SP4, and we have no XP clients
in our environment. Other ideas?

 

[Steven L Umbach]

Not offhand Will. I will look around and post back if I find anything. ---
Steve

 

[Glenn L]

turn on netlogon logging to get more detail the next time it happens..

Location of the log file - %windir%\debug

Command Prompt setting - Enable from command prompt with "NLTEST
/DBFlag:2080FFFF"

Registry Location -
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Registry Setting - Add the REG_SZ value "DBFlag" and set it to
0x02080fff