could i help you?
Main Topics
Browse All Topics
My Situation:
My Situation
Domain Server: Windows server 2003 for Small Business Server Service Pack 2
Intel Xeon CPU 2.80Ghz and 3.62GB of Ram 1 Application server and
Windows XP Professional version 2002 Service Pack 3
Intel Pentium processor 2.80ghz and 1GB of ram
Intel(R) Pro/100 VE Network Card
I connect to company domain via Linksys workgroup switch.
Everyday for past month I get up to 98 occurrences of Event ID 537 and Event ID 529 see
below. ID-537 is always from my login ID-529 is from several different logins. I can log
into the network ok but after I've been on for 1-2 hours I begin loosing network
connectivity and the internet hangs or stops alltogether. I have 13 other users on this
network and none are having this problem.
Normally I have my workstation plugged into a workgroup switch which is shared by a unix
box. I tried plugging the network cable directly into the wall port but same thing
happens. Can you tell me how to 1) find out what is causing this. 2) stop it from
happeninng? 3) fix the problem?
I've pasted event log entries below:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 7/3/2009
Time: 10:00:14 AM
User: NT AUTHORITY\SYSTEM
Computer: NTSERVER
Description:
Logon Failure:
Reason: An error occurred during logon
User Name: Deanna
Domain: BEALEPRO
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC00002EE
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fw
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 6/29/2009
Time: 5:28:20 AM
User: NT AUTHORITY\SYSTEM
Computer: NTSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: info
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_P
Workstation Name: NTSERVER
Caller User Name: NTSERVER$
Caller Domain: BEALEPRO
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1860
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fw
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 7/1/2009
Time: 12:46:05 AM
User: NT AUTHORITY\SYSTEM
Computer: NTSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: adminprog
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_P
Workstation Name: NTSERVER
Caller User Name: NTSERVER$
Caller Domain: BEALEPRO
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1860
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fw
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 6/29/2009
Time: 5:28:08 AM
User: NT AUTHORITY\SYSTEM
Computer: NTSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: admin
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_P
Workstation Name: NTSERVER
Caller User Name: NTSERVER$
Caller Domain: BEALEPRO
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1860
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fw
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 6/29/2009
Time: 5:28:11 AM
User: NT AUTHORITY\SYSTEM
Computer: NTSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: test
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_P
Workstation Name: NTSERVER
Caller User Name: NTSERVER$
Caller Domain: BEALEPRO
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1860
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fw
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Awawada,
Thanks for reply each link gave several possibilities and I had to read/try each one. Unfortunately none worked/applied to my situation. The 529/537 events occurr when I'm logged into the computer. I suspect its some type of malware program because when my pc is turned off I do not get any of these in the event log. Both the links state that the solution is to install the latest sp for windows server 2003 and XP professional. I already have the latest sp for each installed. Would appreciate any other suggestions as to how to track down the cause/fix for this. Please let me know if any additional information about the problem is needed.
If you think its a malware find it out. To remove or find malware i use www.pandasecurity.com. Its a high recommended Antivirus Engine. But because of so many viruses i recomend to scan with many antivirus Engines as possible. So you find below some useful links:
http://www.pandasecurity.c
www.bitdefender.com/scanne
http://www.f-secure.com/en
http://security.symantec.c
http://housecall.trendmicr
http://www.kaspersky.com/v
http://home.mcafee.com/Dow
http://www.eset.com/online
http://onecare.live.com/si
Business Accounts
Answer for Membership
by: awawadaPosted on 2009-07-03 at 11:25:13ID: 24773808
this links may help you: echnet/sup port/ee/tr ansform.as px? ProdNam e=Windows% 20Operatin g%20System &ProdVer=5 .2&EvtID=5 29& EvtSrc= Security&L CID=1033
echnet/sup port/ee/tr ansform.as px? ProdNam e=Windows% 20Operatin g%20System &ProdVer=5 .2&EvtID=5 37& EvtSrc= Security&L CID=1033
http://www.microsoft.com/t
http://www.microsoft.com/t