• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 452
  • Last Modified:

Can I ignore event 537 if it occurs just before shutdown...

Hi

I've received a few Failure Audit errors in my Security event log. The contents of the entry are:

Logon Failure:
       Reason:      An error occurred during logon
       User Name:      MYSERVERNAME$
       Domain:      MYDOMAINNAME.LOCAL
       Logon Type:      3
       Logon Process:      Kerberos
       Authentication Package:      Kerberos
       Workstation Name:      -
       Status code:      0xC00000DC
       Substatus code:      0x0
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID:      -
       Transited Services:      -
       Source Network Address:      -
       Source Port:      -
I have only seen this event logged just prior to event ID 513 (Windows is shutting down) being logged. The shutdowns were initiated by me, so they were planned.

I'm just wondering if this is a  "timing" type of thing since this is SBS and it's all-in-one offering (like with error 4015 in the DNS log which occurs when I do a shutdown). Since error code 0xC00000DC is STATUS_INVALID_SERVER_STATE it would seem to me to be related to the shutdown.

Just want to know if I can safely ignore these events given when they occurred.

Thank you.
0
emgee11
Asked:
emgee11
1 Solution
 
andrew_aj1Commented:
If this only happens durring shutdown it should not be an issue to worry about.
I hope this helps. Good luck.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now