Failure Audit

From: RG (nobody_at_nowhere.com)
Date: 01/28/04 

Date: Wed, 28 Jan 2004 00:03:32 -0500

I am getting the following failure audit every 5 five minutes. It appears
that somebody or something tried to login, but wasn't successful. Would
anyone know the typical cause for this? or where I could dig out more info
so that I could identify the root of the problem?

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 1/27/2004
Time: 11:54:54 PM
User: NT AUTHORITY\SYSTEM
Computer: INTERNAL
Description:
Logon Failure:
  Reason: An error occurred during logon
  User Name:
  Domain:
  Logon Type: 3
  Logon Process: Kerberos
  Authentication Package: Kerberos
  Workstation Name: -
  Status code: 0xC000006A
  Substatus code: 0x0
  Caller User Name: -
  Caller Domain: -
  Caller Logon ID: -
  Caller Process ID: -
  Transited Services: -
  Source Network Address: -
  Source Port: -

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Thanks in advance

Relevant Pages

  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Log Failure Audit
    ... Whenever an invalid logon occurs a "Failure Audit" event is written to the ... but the "Source Network Address" entry is always blank. ... Caller User Name: MyServer$ ...
    (microsoft.public.security)
  • Re: Failure Audit in Security Logs
    ... Event Type: Failure Audit ... Logon Failure: ... Logon Process: NtLmSsp ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Unknown user name or bad password
    ... Event Type: Failure Audit ... Logon Failure: ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Trend Micro WFBS - not!
    ... Event Type: Failure Audit ... An error occurred during logon ... Caller User Name: - ... this is Trend because I saw this a while ago with CSM when the Security ...
    (microsoft.public.windows.server.sbs)