Re: Security Event ID 534

From: Steven Umbach (n9rou_at_n0spam-comcast.net)
Date: 02/24/05

  • Next message: andy smart: "Re: prevent remote desktop connections" 
    Date: Thu, 24 Feb 2005 01:11:58 -0600

    Hmm. Is anybody being denied access to the computer or is anything else failing
    or not working right?? How often are these events showing up?? Is this a domain
    controller? Try enabling auditing of privilege use and object access for failure
    only to see if anything else is being recorded for those audit categories at the
    same time that may provide a clue. There was a problem with Event 534 on XP Pro
    computers, but have not heard about the same problem for Windows 2000. --- Steve

    http://support.microsoft.com/?kbid=841399

    "Richard Smith" <RichardSmith@discussions.microsoft.com> wrote in message
    news:950582DC-8507-46B1-8328-E2B6D541D98D@microsoft.com...
    > Steven, thanks for the reply...
    >
    > I have checked the "deny access from the network" local policy and there are
    > nothing specified. Also there are no corrosponding events in the app and
    > system logs.
    >
    > Im still stumped...
    >
    >
    >
    > "Steven Umbach" wrote:
    >
    > > I am not sure exactly what is going on but the reason would be a lack of
    > > privilege for the user right for access this computer from the network. You
    can
    > > open Local Security Policy and go to security settings/local policies/user
    > > rights and check for that user right and for deny access to this computer
    from
    > > the network that will override any allow settings to make sure it is
    correct.
    > > Normally at least users and administrators have the user right to access
    this
    > > computer from the network. Check the application and system logs to see if
    there
    > > any other possible events correlating to these errors by time. ---- Steve
    > >
    > >
    > > "Richard Smith" <RichardSmith@discussions.microsoft.com> wrote in message
    > > news:9DC611AD-F31E-4F9B-9E71-DFBBE7F000D7@microsoft.com...
    > > > Hello,
    > > >
    > > > I am seeing alot of these Security Event Log errors on my Windows 2000
    > > > Server.
    > > >
    > > > Type: Audit Failure
    > > > Source: Security
    > > > Event ID: 534
    > > > Event Time: <Date and Time>
    > > > User: NT AUTHORITY\SYSTEM
    > > > Computer: <computername>
    > > > Description:
    > > > Logon Failure:
    > > > Reason: The user has not been granted the requested
    > > > logon type at this machine
    > > > User Name:
    > > > Domain:
    > > > Logon Type: 3
    > > > Logon Process: Kerberos
    > > > Authentication Package: Kerberos
    > > > Workstation Name: -
    > > >
    > > > The error seem to be saying that the SYSTEM account is trying to logon
    from
    > > > the Network (logon type 3) and is failing. However I dont understand why
    the
    > > > local System account would be accessing the server from the network!
    Doesnt
    > > > make sense to me.
    > > >
    > > > Any light that could be shed on why Im getting these errors, would be a
    huge
    > > > help.
    > > >
    > > > Many Thanks
    > > >
    > > > Richard
    > >
    > >
    > >

  • Next message: andy smart: "Re: prevent remote desktop connections"

    Relevant Pages

    • RE: Desktop Support Access
      ... Level 1 is the default user EXEC privilege, ... Subject: Desktop Support Access ... Better Management for Network Security ...
      (Security-Basics)
    • Re: Least User Priviledges for Network Administrators
      ... While implementing the principle of least privilege is a noble goal I think ... network, disable Windows Updates because they read somewhere it would slow ... users that need administrator access to logon as a regular user and then use ... administrative rights. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Where is the package manager
      ... Nope, i only have devices, printing, screens, network and system logs, ... no package manager (note, those names might not be exactly the correct ...
      (Ubuntu)
    • Re: security
      ... > WDM> access privileges! ... privilege is, that means asp.net should run as "Localsystem". ... > WDM> API NetUseAdd through PInvoke. ... > I'm not sure this will be fast enough to map different network share for ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: Security Event ID 534
      ... I have checked the "deny access from the network" local policy and there are ... Check the application and system logs to see if there ...
      (microsoft.public.win2000.security)