Event 538 with no corresponding logon

From: Michael (nospam_at_nospam.no)
Date: 07/01/04

  • Next message: christy: "will the TGT destroyed if user locks windows" 
    Date: Thu, 1 Jul 2004 11:41:30 +0200

    Hi all,

    I know that this has come up in some past threads, but I can't find them and
    this is the first time I ever see this problem. I have 2 Windows 2000 Server
    member servers that are running Terminal Services and Citrix MetaFrame. They
    both have RestrictAnonymous set to 2 (I just verified it). They were
    installed in December of last year and have been running fine until a couple
    of days ago. Now all of a sudden the security logs are being filled with
    Event 538 ANONYMOUS LOGON from NT AUTHORITY of type 3 and there is no
    corresponding logon for any of the events. I've been searching on KB,
    EventID.net and everywhere else, and in NO place does it actually explain
    why this occurs, only that it occurs. The comments on EventID.net only
    allude to the fact that this event can "happen" with no associated logon,
    but doesn't actually explain why or how to stop it. Another site brings up
    this problem along with another one, but then only goes into detail on the
    other problem.

    By the way, the only thing we changed on these systems in the last couple of
    days was move them to a switch from a hub, and change all the network cards
    and switch ports to 100/full duplex. These events seem to have started right
    after this change.

    Can anyone shed some light on this?

    Thanks in advance.

    Michael S.

  • Next message: christy: "will the TGT destroyed if user locks windows"

    Relevant Pages

    • Re: Terminal Server access error
      ... "You do not have access to logon to this Session" ... with the Remote Administration, you may receive "You do not have access to ... this issue occurs because W2K server running Terminal Services ...
      (microsoft.public.windows.server.networking)
    • Event ID: 537 Kerberos
      ... Domain is a Windows 2000 Domain ... I think this happened after SP1 was installed on the member servers ... An error occurred during logon ... Caller User Name: SERVER-2$ ...
      (microsoft.public.windows.server.general)
    • Re: Terminal Services "You do not have access to logon to this Seesion."
      ... "You do not have access to logon to this Session" ... with the Remote Administration, you may receive "You do not have access to ... this issue occurs because W2K server running Terminal Services ...
      (microsoft.public.windows.server.networking)
    • Re: DC failure
      ... Meinolf Weber wrote: ... If all DC's will be down, NO user is able to logon to the domain, so they can not use the ressources of the servers. ... Your member servers will still run, but can not be accessed from the clients. ...
      (microsoft.public.windows.server.active_directory)
    • local logon on member servers
      ... How can I allow the local administrator password to logon ... locally on one of my member servers? ... I have added the local admin in the Local Policy so that ...
      (microsoft.public.win2000.active_directory)