|
Posted by Bill Glidden on March 28, 2007, 8:29 pm
If you were Registered and logged in, you could reply and use other advanced thread options
I have searched for an answer to this for a couple of hours but cannot find
one. Lots of near misses, though. This is what I have been getting in the
Security Log for about a week now:
Event ID 537
Logon Failure:
Reason: An error occurred during logon
Username:
Domain:
Logon Type: 3
Logon Process: ΠωΡ
Authentication Package: NTLM
Workstation Name:
Status Code: 0x80090308
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
This SBS 2003 SP1 Premium server seems to otherwise be running OK.
Any ideas, anyone?
TIA,
Bill
|
|
Posted by on March 29, 2007, 11:56 am
If you were Registered and logged in, you could reply and use other advanced thread options
It looks like a cryptographic error (0x80090308) upon a network logon
request (Logon Type 3). Is the computer that generated the event
(listed under workstation name) a member of the domain, with the SBS
server as the domain controller? If so, you might try rejoining the
workstation to the domain.
J Wolfgang Goerlich
> I have searched for an answer to this for a couple of hours but cannot fi=
nd
> one. Lots of near misses, though. This is what I have been getting in the
> Security Log for about a week now:
>
> Event ID 537
> Logon Failure:
> Reason: An error occurred during logon
> Username:
> Domain:
> Logon Type: 3
> Logon Process: =D0=F9=D1
> Authentication Package: NTLM
> Workstation Name:
> Status Code: 0x80090308
> Substatus code: 0x0
> Caller User Name: -
> Caller Domain: -
> Caller logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
> This SBS 2003 SP1 Premium server seems to otherwise be running OK.
>
> Any ideas, anyone?
>
> TIA,
> Bill
|
|
Posted by Bill Glidden on March 29, 2007, 6:37 pm
If you were Registered and logged in, you could reply and use other advanced thread options
The Workstation Name is blank so I don't see how I would identify it.
Cheers,
Bill Glidden
It looks like a cryptographic error (0x80090308) upon a network logon
request (Logon Type 3). Is the computer that generated the event
(listed under workstation name) a member of the domain, with the SBS
server as the domain controller? If so, you might try rejoining the
workstation to the domain.
J Wolfgang Goerlich
> I have searched for an answer to this for a couple of hours but cannot
> find
> one. Lots of near misses, though. This is what I have been getting in the
> Security Log for about a week now:
>
> Event ID 537
> Logon Failure:
> Reason: An error occurred during logon
> Username:
> Domain:
> Logon Type: 3
> Logon Process: ΠωΡ
> Authentication Package: NTLM
> Workstation Name:
> Status Code: 0x80090308
> Substatus code: 0x0
> Caller User Name: -
> Caller Domain: -
> Caller logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
> This SBS 2003 SP1 Premium server seems to otherwise be running OK.
>
> Any ideas, anyone?
>
> TIA,
> Bill
|
|
Posted by on April 1, 2007, 7:56 pm
If you were Registered and logged in, you could reply and use other advanced thread options > The Workstation Name is blank so I don't see how I would identify it.
Blank, really? I assumed you took it out of the event log when pasting
it to the group. Interesting. Is the logon process really " =D0=F9=D1 ",
then?
J Wolfgang Goerlich
|
|
Posted by Bill Glidden on April 1, 2007, 8:09 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Correct - the event information was pasted 'as is'.
Cheers,
Bill
> The Workstation Name is blank so I don't see how I would identify it.
Blank, really? I assumed you took it out of the event log when pasting
it to the group. Interesting. Is the logon process really " ΠωΡ ",
then?
J Wolfgang Goerlich
|
| Similar Threads | Posted | | centralized event logging? centralized syslog... dumping event log? splunk? | February 17, 2007, 2:55 am |
| Event log | December 12, 2005, 7:32 am |
| Event ID 22. | February 9, 2006, 3:49 pm |
| Event ID 626 | October 3, 2006, 4:51 pm |
| Event ID: 537 | October 30, 2006, 6:00 am |
| Event ID: 675 | September 12, 2007, 10:38 am |
| Event ID 560 | August 4, 2008, 1:52 pm |
| event id 577 | August 4, 2008, 1:58 pm |
| Event ID 675 | August 25, 2008, 10:19 pm |
| event id 4306 | September 26, 2005, 7:37 pm |
|
XML site map