Event IDs 565, 675, 537

From: CAL (cal_at_alphaengr.com)
Date: 07/24/03 

Date: Thu, 24 Jul 2003 05:31:01 -0700

I get Event ID 565, with symptoms as in KB Article 319672
and Event ID 675, with symptoms as in KB Article 328570,
except all my clients were added after a clean install of
SBS Server 2000 with active directory, not an upgrade.
I also get Event ID 537. I have applied SP4, with no
effect. Can anyone steer me in the right direction?
Here are samples of the events (recreated from printouts):
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: Todays date
Time: Todays time
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Pre-authentication failed:
        User Name: RECEPTIONIST$
        User ID: DomainName\RECEPTIONIST$
        Service Name: brbtgt/DOMAINNAME.COM
        Pre-Authentication Type: 0x2
        Failure Code: 0x25
        Client Address: 10.xx.xxx.xx

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: Todays date
Time: Todays time
User: DomainName\MJohnson
Computer: SERVERNAME
Description:
Object Open:
        Object Server: Microsoft Exchange
        Object Type: Microsoft Exchange Logon
        Object Name: /o=DomainName/ou=first
administrative group/cn=Recipients/cn=MJohnson
        New Handle ID: -
        Operation ID: {o,722976}
        Process ID: 5012
        Primary User Name: SERVERNAME$
        Primary Domain: DomainName
        Primary Logon ID: (0x0,0x3E7)
        Client User Name: MJohnson
        Client Domain: DomainName
        Client Logon ID: (0x0,0xB080B)
        Accesses Unknown specific access (bit 8)

        Priveleges

 Properties:
Unknown specific access (bit 2)
Unknown specific access (bit 3)
                Send As

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: Todays date
Time: Todays time
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Logon Failure:
        Reason: An unexpected error occurred
during logon
        User Name:
        Domain:
        Logon Type: 3
        Logon Process: Kerberos
        Authentication Package: Kerberos
        Workstation Name: -

The domain and server names have been omitted. All other
info, including blanks are exactly as in the errors. The
537 and 675 have the exact same event time. The errors
are not restricted to these 2 users.

Any help would be appreciated
Thanks
CAL

Relevant Pages

  • Event Log - Security - Numerous Failures
    ... Event Type: Failure Audit ... Computer: <servername> ... The logon to account: Administrator ...
    (microsoft.public.windows.server.security)
  • Re: Event ID 565, 675
    ... >> warranties, and confers no ... Event Type: Failure Audit ... Computer: SERVERNAME ...
    (microsoft.public.win2000.security)
  • change administrator password
    ... the Security Event Viewer. ... Is there a procedure to follow when changing the administrator password, ... Event Type: Failure Audit ... Logon Failure: ...
    (microsoft.public.win2000.security)
  • Rogue Workstation?
    ... I noticed the following entries in the Security log of one of my Windows ... Event Type: Failure Audit ... The logon to account: Administrator ...
    (microsoft.public.windows.server.active_directory)
  • Re: Help - RPC over http credential issue
    ... I am showing the following errors in my DC event security log: ... Event Type: Failure Audit ... Logon Failure: ...
    (microsoft.public.exchange.setup)