Re: EventID 534: User has not been granted requested logon type
From: Glenn L (the.only(delete)_at_gmail)
Date: 05/07/05
- Previous message: Glenn L: "Re: DSACLS and joining a domain"
- In reply to: Steven L Umbach: "Re: EventID 534: User has not been granted requested logon type"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 7 May 2005 00:52:10 -0700
turn on netlogon logging to get more detail the next time it happens..
Location of the log file - %windir%\debug
Command Prompt setting - Enable from command prompt with "NLTEST
/DBFlag:2080FFFF"
Registry Location -
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Registry Setting - Add the REG_SZ value "DBFlag" and set it to
0x02080fff
-- Glenn L CCNA, MCSE 2000/2003 + Security "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message news:OCyQtZZUFHA.228@TK2MSFTNGP12.phx.gbl... > Not offhand Will. I will look around and post back if I find > nything. --- Steve > > > "Will" <DELETE_westes@earthbroadcast.com> wrote in message > news:z_GdnaSuJZX7CeTfRVn-1A@giganews.com... >>I see these messages on Windows 2000 Server SP4, and we have no XP clients >> in our environment. Other ideas? >> >> -- >> Will >> >> >> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message >> news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl... >>> There was a problem with this on XP Pro computers if that is where you >>> are >>> seeing them as shown in the link below. --- Steve >>> >>> http://support.microsoft.com/?kbid=841399 >>> >>> "Will" <DELETE_westes@earthbroadcast.com> wrote in message >>> news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl... >>> > In general I'm familiar with Event ID 534, which is a Security >> Eventviewer >>> > log message that indicates that "the user has not been granted the >>> > requested >>> > logon type at this machine". What is confusing me is that I >> frequently >>> > see these eventids with a logon type of 3 (network logon) where the >>> > username >>> > and domain are *blank*. Workstation name is also blank. I >>> > thought >>> > that this might be an anonymous logon request, but what is all the >>> > more >>> > perplexing is that the logon process is Kerberos. >>> > >>> > What are the possible sources of such a request? >>> > >>> > -- >>> > Will >>> > >>> > >>> > >>> >>> >> >> > >
- Previous message: Glenn L: "Re: DSACLS and joining a domain"
- In reply to: Steven L Umbach: "Re: EventID 534: User has not been granted requested logon type"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
