Kerberos Logon Failure in Security Log

[Guest]

I get numerous 534 events in my security log on a W2K Terminal Server. What's really puzzling is the username, domain, and Workstation are all blank. The logon type is 3, and the logon process and Authentication package is Kerberos. These events are occuring on both of my W2K Term Servers. I cannot find any reference to them. I have run netdiag and kerbtray and don't see any problems. Anyone have any ideas?

 

[Steven L Umbach]

That Event ID generally means someone is getting denied access because they do not
have the user right for the logon type. Users [as you probably know] need logon
locally user right to access a terminal server which they should have by default
unless it is a domain controller. Not sure why the info is blank. You might need to
try to use netmon to see if you can track an ip address to the Event ID or install a
program like Sygate persona firewall that has extensive logging. You can disable the
firewall function and just use it for the logging. Then you could match the times in
the firewall log to the Event ID's to hopefully see what computers are causing the
Events ID's. --- Steve

http://www.intellipool.com/main.cgi?page=34

I get numerous 534 events in my security log on a W2K Terminal Server. What's

really puzzling is the username, domain, and Workstation are all blank. The logon
type is 3, and the logon process and Authentication package is Kerberos. These
events are occuring on both of my W2K Term Servers. I cannot find any reference to
them. I have run netdiag and kerbtray and don't see any problems. Anyone have any
ideas?

 

[Guest]

I did do a netmon capture and filtered for SMB. I discovered the machines, but there should be no reason at all for these users to continually attempt to access the TS (it's used for specialized purposes not the general domain populace so it's locked down for access). It also does not explain why all of the info is blank.