Event 539 with computer$ account

Event 539 with computer$ account
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Event 539 with computer$ account Clint 08-02-2006
Posted by =?Utf-8?B?Q2xpbnQ=?= on August 2, 2006, 12:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I am receiving the following:

Reason: Account locked out
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: Computername
Caller User Name: Computername$
Caller Domain: Domain1
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1188
Transited Services: -
Source Network Address: -
Source Port: -

This is a domain controller. I recognize that Logon Type: 3 is supposed to
be access from the network but the Caller User Name is the computername$
account. Any ideas? Does my domain controllers computer account password
need to be reset?

BTW, lockout policy is 90 minutes

Posted by =?Utf-8?B?UXUzM24gQmVl?= on August 3, 2006, 11:30 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I am receiving the same logon failure events
hope someone can help me with this - I can't find any info out there!
I have a series of logon failure recorded to one of the File+Print servers
on my mixed-mode W2K3 domain (2000/XP clients).

Event ID 539
Logon Failure
Reason: Account locked out
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: FILESERVER$
Caller User Name: FILESERVER$
Caller Domain: <snipped - but the domain name was correct>

I don't understand why the User Name and Domain fields are blank! Also, if
the logon failed due to the account being locked out, what account object was
referenced? If an account doesn't exist (username blank) how can it be locked
out?

I would like to get to the bottom of this, as it has me stumped.

Similar ThreadsPosted
Account is unlocked but no 671 event is recorded August 7, 2006, 6:10 am
Event ID 537 in Security Log for admin account June 12, 2007, 1:28 pm
Account Lockout event log only recorded ... sometimes December 14, 2007, 12:33 pm
why has my .net account hijacked my computer? November 10, 2005, 12:21 pm
Allow users to change Description attribute for computer account July 11, 2005, 5:15 pm
centralized event logging? centralized syslog... dumping event log? splunk? February 17, 2007, 2:55 am
Attached files to a Hotmail free email account can't be opened in a wxp guest account January 20, 2007, 7:47 pm
Renamed Local Administrator Account Name Reverts to Old Account Name November 30, 2005, 4:39 am
Computer Hacker is illegally creating a new logon on my computer November 10, 2007, 9:32 pm
User Permissions Differ from Computer to Computer October 24, 2005, 7:16 pm

The site map in XML format XML site map

Contact Us | Privacy Policy