Can't login the morning after.

From: Rich K (rich@raclink.com)
Date: 08/14/02 

From: "Rich K" <rich@raclink.com>
Date: Tue, 13 Aug 2002 15:32:25 -0700

Ok, I turned on Security Auditing for failed and
Successful logon attempts on the Windows XP machine in
question. I tried to log on after a reboot and got 2
failed attempts followed by a successful one in three
trys. I checked the Event Viewer and got failed audits
followed by an Event ID 597 which had to do
with "Recovery of Data Protection Master Key" from the
domain controller. The Event ID 597 was a successful
audit and from that point forward the user was able to
logon after multiple reboots without getting a error
message. The Knowledge Base has no articles on Event 597
(It might shed light on a problem, they need to post ALL
Event ID's not just some of them).

I didn't do anything to this machine other then turn on
auditing. I don't know what to tell you other then
something seems to not be syncing with the server when
the machine shuts down and thus when it starts back up
again and the user can't logon until the workstation and
server re-syncronize. How my problem went away by turning
on Security Auditing is a mystery only MS can answer.

If you find anything else out please post it here because
I'm sure this wont be the last time this is going to
happen.

>-----Original Message-----
>Hi everyone:
>
>Here's the scoop:
>1 Windows 2000 server and a slew (about 50) Windows XP
>Pro workstations. Each night we RESTART the
workstations.
>In the morning, most of them won't login (actually, it's
>more accurate to say that they take forever to do so
>after which the network drives aren't connected
properly).
>
>If we reboot them first, they login in nice and fast
with
>proper working network drives.
>
>Each workstation has netbios turned off, and uses no
WINS
>addresses or LMHOST file.
>
>Each workstation has one and only one DNS entry to the
AD
>server (which runs its own DNS and points to itself
>only).
>
>I suspect that the workstations might be more that 5
>minutes out of sync with the server causing kerberos
>problems but I haven't confirmed this.
>
>Anyway, maybe the problem is a little less bizzare. What
>do you think?
>
>I'm desparate since our NT 4 network ran hitchless for
>years and this is making me look like a putz. Can you
>say "back to NT 4 on the server??"
>
>Cheers and TIA!
>Bruce.
>.
>

Relevant Pages

  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: DCOM Errors in Event log
    ... A time difference between the workstation and the server do you? ... An error occurred during logon ... Les Connor [SBS Community Member - SBS MVP] ... on the server in the security log we are getting error 537 in the event log. ...
    (microsoft.public.windows.server.sbs)
  • Re: Server is working but unable to logon by any means
    ... I changed the registry settings back to original settings and rebooted after ... So I've rebooted the server with no changes done at all. ... Safe Mode is not working - same issue it will not display logon screen ... difference after reboot. ...
    (microsoft.public.windows.server.general)
  • Re: Event ID 537
    ... Nothing on workstation has changed, although I have recently applied SP1 for the SBS2003 server. ... I have around 2000-3000 errors in my event log. ... An error occurred during logon ...
    (microsoft.public.windows.server.sbs)