Login Failure Security logs
Hi guys.
I've started seeing the below logs on our SBS 2003 the last few days. No username is being listed. Not sure why it's started all of a sudden. I've made no changes to the server lately apart from installing an ESET AV solution, but that
was over a month ago. As it's a security thing is there a call for me to be worried? Or could this be an innocent log being used by another service/protocol? Thanks in advance for any guidance - (I've changed the username and server name in the screen
shot below for security reasons).
Source
Event ID
Last Occurrence
Total Occurrences
Security
537
17/05/2011 05:40
164 *
Logon Failure:
Reason:
An error occurred during logon
User Name:
-
Domain:
-
Logon Type:
5
Logon Process:
Advapi
Authentication Package:
Negotiate
Workstation Name:
-
Status code:
0xC00000EE
Substatus code:
0xC00000EE
Caller User Name:
JUPITER$
Caller Domain:
MYDOMAIN
Caller Logon ID:
(0x0,0x3E7)
Caller Process ID:
456
Transited Services:
-
Source Network Address:
-
Source Port:
-
May 17th, 2011 11:54am
Hi Customer,
There is similar case you could take reference. Please try to stop sharepoint to test.
WSS 3.0 Search Service Account Event ID 537 Logon Failure
http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/ea0a3338-e93b-4ee3-af9e-b606746d606fRegards,
Rick Tan
Free Windows Admin Tool Kit Click here and download it now
May 18th, 2011 12:34pm
Hi Customer,
There is similar case you could take reference. Please try to stop sharepoint to test.
WSS 3.0 Search Service Account Event ID 537 Logon Failure
http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/ea0a3338-e93b-4ee3-af9e-b606746d606f
Regards,
Rick Tan
Thanks for the reply Rick. I will take a look at this. Andy
May 23rd, 2011 11:15am