Event Details
User Activity->Logons->Failed Logons->Windows 2000-2003->EventID 537 - An unexpected error occurred during logon
EventID 537 - An unexpected error occurred during logon
 Sample:
Event Type:	       Failure Audit
Event Source:      Security
Event Category:  Logon/Logoff 
Event ID:	       537
Date:	       11.12.2011
Time:	       2:00:49
User:	       NT AUTHORITY\SYSTEM
Computer:	       DCC1
Description:
Logon Failure:
 	Reason:		An error occurred during logon
 	User Name:	
 	Domain:		
 	Logon Type:	                      3
 	Logon Process:	Authz   
 	Authentication Package:	Kerberos
 	Workstation Name:	DCC1
 	Status code:	                     0xC000018B
 	Substatus code:	0x0
 	Caller User Name:	NETWORK SERVICE
 	Caller Domain:	NT AUTHORITY
 	Caller Logon ID:	(0x0,0x3E4)
 	Caller Process ID:	1588
 	Transited Services:	-
 	Source Network Address:	-
 	Source Port:	-


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Source Security
Category Logon/Logoff
EventId 537
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name
What The type of activity occurred (e.g. Logon, Password Changed, etc.) Category Logon
Where The name of the workstation/server where the activity was logged. Computer 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. Workstation Name
Severity Specify the seriousness of the event. "High" High
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Failed" Failed
Failure Reason Failure Reason - Bad user name or password, not enough privileges, etc. "An unexpected error occurred during logon" An unexpected error occurred during logon
Comments
You must be logged in to comment