Event ID 537 - Windows Server 2003

Hi there,

We have Domain Controller (Windows Server 2003 SP1). In the event log we
have many many events 537:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 12-2-2007
Time: 17:32:58
User: NT AUTHORITY\SYSTEM
Computer: ######
Description:
Logon Failure:
Reason: An error occurred during logon
User Name: XP-WS-38$
Domain: ########.LOCAL
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC0000133
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.1.1.179
Source Port: 0

The events are comming from several workstations.

Does anyone have a idea?

Best Regards,

Ferdi

Kerry
Tue Feb 13 09:45:08 CST 2007

Have you checked eventid.net?

http://www.eventid.net/display.asp?eventid=537&eventno=194&source=Security&phase=1

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca


"Ferdi" <Ferdi@discussions.microsoft.com> wrote in message
news:970B0D0E-81CD-47D5-A634-5458E441BABE@microsoft.com...
> Hi there,
>
> We have Domain Controller (Windows Server 2003 SP1). In the event log we
> have many many events 537:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 537
> Date: 12-2-2007
> Time: 17:32:58
> User: NT AUTHORITY\SYSTEM
> Computer: ######
> Description:
> Logon Failure:
> Reason: An error occurred during logon
> User Name: XP-WS-38$
> Domain: ########.LOCAL
> Logon Type: 3
> Logon Process: Kerberos
> Authentication Package: Kerberos
> Workstation Name: -
> Status code: 0xC0000133
> Substatus code: 0x0
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: 192.1.1.179
> Source Port: 0
>
> The events are comming from several workstations.
>
> Does anyone have a idea?
>
> Best Regards,
>
> Ferdi
>

Violent
Wed Feb 14 07:58:27 CST 2007

I think that the problem is in the local user's comp profile.Check it .. and
maybe you must create another one ..

"Ferdi" wrote:

> Hi there,
>
> We have Domain Controller (Windows Server 2003 SP1). In the event log we
> have many many events 537:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 537
> Date: 12-2-2007
> Time: 17:32:58
> User: NT AUTHORITY\SYSTEM
> Computer: ######
> Description:
> Logon Failure:
> Reason: An error occurred during logon
> User Name: XP-WS-38$
> Domain: ########.LOCAL
> Logon Type: 3
> Logon Process: Kerberos
> Authentication Package: Kerberos
> Workstation Name: -
> Status code: 0xC0000133
> Substatus code: 0x0
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: 192.1.1.179
> Source Port: 0
>
> The events are comming from several workstations.
>
> Does anyone have a idea?
>
> Best Regards,
>
> Ferdi
>

Ferdi
Wed Mar 07 02:04:10 CST 2007

It's on several computers, what must\can i check?

"Violent" wrote:

> I think that the problem is in the local user's comp profile.Check it .. and
> maybe you must create another one ..
>
> "Ferdi" wrote:
>
> > Hi there,
> >
> > We have Domain Controller (Windows Server 2003 SP1). In the event log we
> > have many many events 537:
> >
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 537
> > Date: 12-2-2007
> > Time: 17:32:58
> > User: NT AUTHORITY\SYSTEM
> > Computer: ######
> > Description:
> > Logon Failure:
> > Reason: An error occurred during logon
> > User Name: XP-WS-38$
> > Domain: ########.LOCAL
> > Logon Type: 3
> > Logon Process: Kerberos
> > Authentication Package: Kerberos
> > Workstation Name: -
> > Status code: 0xC0000133
> > Substatus code: 0x0
> > Caller User Name: -
> > Caller Domain: -
> > Caller Logon ID: -
> > Caller Process ID: -
> > Transited Services: -
> > Source Network Address: 192.1.1.179
> > Source Port: 0
> >
> > The events are comming from several workstations.
> >
> > Does anyone have a idea?
> >
> > Best Regards,
> >
> > Ferdi
> >