Event ID 537 error

[beulah08]

Event log in W2k server continually gives this event:
Failure Audit.... Event ID 537..... Reason: An unexpected error ocurred during logon.

No user name or domain is listed, Logon type =3, process = Kerberos.

Cannot find anything on Microsoft or Tech Net or any other source. Any ideas? Seems to happen randomly throughout the day. Domain is mixed mode.

 

[viciousdogs]

I get exactly the same error. Do you think it might have something to do with still having NT4 clients on the network?

 

[quell]

lmao...this was copied form M$ site....537 Logon failure. The logon attempt failed for other reasons.
Note: In some cases, the reason for the logon failure may not be known.

I did a search on google for this and found a few things. It appears to be some sort of miscommunications between 2 or more DC and Event ID 537 is an catch all login error. If M$ sees that there is a login error and can not classify it..it gives this error code. Here are some links that I have found Hope this helps out a little.
1.

http://www.experts-exchange.com/Networking/Q_20727539.html

The solution (if you can call it that) was to upgrade to IE 6.0 or add
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"DnsCacheTimeout"=dword:5460
to the registry.
This sets DNS cache timout to 6 hours,
2.

http://www.jsiinc.com/SUBI/tip4400/rh4432.htm

3.

http://www.microsoft.com/technet/tr...windows2000serv/maintain/monitor/logonoff.asp

----Failed logon part of the article.

 

[beulah08]

I'm not sure where I finally read this, but I read that it might have something to so with time synchronization so I researched further on time synchronization and ran Net Time to synchronize with a time server (U.S. Navy?) and I quit getting the errors. Not a single one since.

 

[KCDave03]

I just started seeing this on a server which is running W2K SP3 with Terminal Services in Application mode. I think it has something to do with authentication. This server is in a child active directory domain. I cannot UNC to the server without getting the 'Logon Failure: The target account name is incorrect' message. Also, when I go to a command prompt and type 'NET VIEW SERVERNAME' I receive an 'Access Denied' message even though I am part of a global group which is a member of the Local Administrator group. I have verified that I can ping/UNC to the DNS domain controllers and WINS servers.

I tried NET TIME, the registry hack listed above - no luck yet.

any more ideas?

 

[JPCPB]

Greetings,

Have a look at this article:

http://www.eventid.net/display.asp?eventid=537&source=

Kindest regards,

James