Event ID 537 on all DCs 2

[Dfig]

We have 2 DCs running Win 2003 R2 SP2. The Security Logs in Event Viewer have been logging Event ID 537 for a while on both DCs. It occurs with different workstations on different subnets and non DC member Servers. Here are a couple of entries:


Date: XXXXXXXXXXX Source: Security
Time XXXXXXXXXXX Category: Logon/Logoff
Type: Failure Aud Event ID: 537
User: NT AUTHORITY\SYSTEM
Computer: DC1

Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC000006D
Substatus code: 0xC0000133
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 172.16.31.61
Source Port: 1039


For more information, see Help and Support Center at
--------------------------------------------------------------------------------
Date: XXXXXXXXXXX Source: Security
Time XXXXXXXXXXX Category: Logon/Logoff
Type: Failure Aud Event ID: 537
User: NT AUTHORITY\SYSTEM
Computer: CITRIX

Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: NYF-CITRIX
Status code: 0xC00000DC
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 172.16.8.10
Source Port: 0


For more information, see Help and Support Center at

I am trying to find out what affect if any these errors have on our network.

 

[allywilson]

Well the errors are just showing failed authentication - so something is trying to authenticate. Find out what. I don't think authentication takes up much bandwidth to be honest.

Run ethereal/wireshark on the network (preferably span out a port from a switch) and check out what traffic is going where, etc. and see if you can find any obvious patterns.

 

[Dfig]

Thanks allywilson. I'll try that. I did not know if this was cause for concern. If I remember correctly, this started happening after I promoted a server to a DC with DCPromo.

 

[ITPangaeaArchitect]

that would be true...until its a DC, it cant log domain authentications. once you made it a DC, now failed authentications from any machine with a secure channel to it will be logged as long as those authentications are from a domain based account (or foreign security principal, such as SYSTEM)

-Brandon Wilson
MCSE:Security00/03
MCSA:Messaging00
MCSA:Security03
A+