Solved

Windows 2003 Event Viewer > Security > Failure Audit > Event id 537

Posted on 2011-03-16
6
1,193 Views
Last Modified: 2012-08-13
Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      537
Date:            3/16/2011
Time:            7:18:05 AM
User:            NT AUTHORITY\SYSTEM
Computer:      SERVER
Description:
Logon Failure:
       Reason:            An error occurred during logon
       User Name:      
       Domain:            
       Logon Type:      3
       Logon Process:      Kerberos
       Authentication Package:      Kerberos
       Workstation Name:      -
       Status code:      0xC000006D
       Substatus code:      0xC0000133
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID:      -
       Transited Services:      -
       Source Network Address:      10.0.1.4
       Source Port:      17981


I have 19 occurences within last 72 hours

10.0.1.4 detected as  Netgear,In:00:AF:09

I have only one NetGear product in the network and that would be Neatgear Prosfafe VPN Firewall FVS318, which I used to make an extra connection for a PC without ethernet jack


So what's going on here?

0
Comment
Question by:Anti-Mhz
  • 3
  • 3
6 Comments
 
LVL 1

Author Comment

by:Anti-Mhz
ID: 35152287
Verified, the MAC address is the one of the device mentioned above
0
 
LVL 1

Author Comment

by:Anti-Mhz
ID: 35152392
source port varies from entry to entry
18276
17981
17924
0
18429
17982
17976
18381
18384
18373
17930
18303


which falls into range of 17924-18429, which is not of any known allowed services listed on router.

-noticed that the router password was set as default, changed

0
 
LVL 13

Expert Comment

by:IT-Monkey-Dave
ID: 35152417
Do you have a mix of 2003 & 2008/R2 domain controllers?
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 1

Author Comment

by:Anti-Mhz
ID: 35152516
no, in this scenario theres only one DC and its running 2003 SP2
0
 
LVL 13

Expert Comment

by:IT-Monkey-Dave
ID: 35152600
Are the user, workstation, and domain names actually blank like that?  Is there a consistent time interval between the errors or are they pretty random?  (sorry I only have questions at the moment)
0
 
LVL 13

Accepted Solution

by:
IT-Monkey-Dave earned 250 total points
ID: 35152679
(I admit I'm googling)  

Event ID 537 and error code 0xC0000133 may be related to a time synchronization problem somewhere.  

Substatus code:  0xC0000133 supposedly means “The time at the primary domain controller is different from the time at the backup domain controller or member server by too large an amount.”
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Home Router DHCP query 9 52
Public IP Address - Subnet 4 42
How to rollback Windows updates with SCCM? 6 74
BGP Local Preference 5 44
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Arrow Electronics was searching for a KVM  (Keyboard/Video/Mouse) switch that could display on one single monitor the current status of all units being tested on the rack.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question