Can I ignore event 537 if it occurs just before shutdown...
Posted on 2008-10-29
I've received a few Failure Audit errors in my Security event log. The contents of the entry are:
Reason: An error occurred during logon
User Name: MYSERVERNAME$
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC00000DC
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
I have only seen this event logged just prior to event ID 513 (Windows is shutting down) being logged. The shutdowns were initiated by me, so they were planned.
I'm just wondering if this is a "timing" type of thing since this is SBS and it's all-in-one offering (like with error 4015 in the DNS log which occurs when I do a shutdown). Since error code 0xC00000DC is STATUS_INVALID_SERVER_STATE it would seem to me to be related to the shutdown.
Just want to know if I can safely ignore these events given when they occurred.