Solved

NT AUTHORITY\SYSTEM,Logon Failure, how can I fix this

Posted on 2004-04-14
7
1,218 Views
Last Modified: 2013-12-04
NT AUTHORITY\SYSTEM,Logon Failure shows up under Event ID 537.  How can I address this event so it doesn't happen again?

Thanks.
0
Comment
Question by:g000se
  • 4
  • 3
7 Comments
 
LVL 82

Expert Comment

by:oBdA
ID: 10826493
You're a bit sparse with information here. When does that error show up? On which Windows version(s) does it show up? What is the exact error text in the event viewer?
0
 
LVL 11

Author Comment

by:g000se
ID: 10827693
Sorry about that.  Windows 2000 server, service pak 4.  

537,AUDIT FAILURE,Security,Thu Apr 08 12:37:28 2004,NT AUTHORITY\SYSTEM,Logon Failure:     Reason:  An unexpected error occurred during logon     User Name:      Domain:       Logon Type: 3     Logon Process: Kerberos     Authentication Package: Kerberos     Workstation Name: -  

Thanks for your help.
0
 
LVL 82

Accepted Solution

by:
oBdA earned 250 total points
ID: 10828084
At which occasions does this error occur, and is there anything else running on that machine (Exchange, IIS, ...)?
I'm afraid I have no real ideas at the moment; check out those maybe:

Event ID: 537
http://www.eventid.net/display.asp?eventid=537&eventno=194&source=Security&phase=1

Active directory logon/logoff problem
http:Q_20727539.html
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 11

Author Comment

by:g000se
ID: 10834974
The server is a DC, with Wins secondary, dhcp, and global catalog, file and print sharing as well.
0
 
LVL 11

Author Comment

by:g000se
ID: 10835960
Thanks for the link.  It has been very useful.
0
 
LVL 82

Expert Comment

by:oBdA
ID: 10837564
Glad you could solve it with the bit of information I was able to provide; may I ask what the problem was?
0
 
LVL 11

Author Comment

by:g000se
ID: 10891685
The link to the eventID.net  helped me to better troubleshoot the issue, because users were prompted to change their passwords.  :)
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

The term "Bad USB" is a buzz word that is usually used when talking about attacks on computer systems that involve USB devices. In this article, I will show what possibilities modern windows systems (win8.x and win10) offer to fight these attacks wi…
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now