Hi I have a Farm with 2 WFEs + 1 APP... I began to notice that following event appears in the security log: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 537 Date: 7/04/2010 Time: 1:32:10 PM User: NT AUTHORITY\SYSTEM Computer: WFESERVER1 Description: Logon Failure: Reason: An error occurred during logon User Name: Domain: Logon Type: 3 Logon Process: Authz Authentication Package: Kerberos Workstation Name: WFESERVER1 Status code: 0xC000018B Substatus code: 0x0 Caller User Name: mosSserverfarmAcct Caller Domain: ME_DOMAIN Caller Logon ID: (0x0,0x298EC) Caller Process ID: 2332 Transited Services: - Source Network Address: - Source Port: - It seems to have appear at irregular account once to twice a day. I looked for the eventid on the web but does not seem to be able to find anything meaningful (to me). What puzzled me is that there is no value for username and domain, and source... can someone tell me how should I approach this problem? Thanks

Hi, It seems to be a Kerberos related issue. How does Kerberos authentication work on your farm? What is the OS of WFESERVER1?You can enable Kerberos debug logging on WFESERVER1 to further troubleshoot this issue. Thanks & Regards.Lily Wu

I don't know...because we are supposed using NTLM only....but I will try Kerberos debug logging.....