Windows Forum
Does anyone know how to turn just these events OFF without turning off Logon Failure Auditing?
We have a mixed NT4/2000 environment....but are unable to ascertain source(s) of thousands of these events....
by joseph moore
Well, here is Event ID 537:
Event ID: 537
Type: Failure Audit
Description: Logon Failure:
Reason: An unexpected error occurred during logon
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 Workstation Name: %6
by joseph moore
You get the user name AND the workstation name the logon error came from.
I would check the System log on this workstation for Netlogon errors.
But no, if you disable Failed Logons auditing, then you will get none.
Also, there is a tool in the Windows2K Resource Kit called the Cybersafe Log Analyst. It is a great tool for parsing the Security log and making readable reports from it. I highly recommend it. I had trouble with my Security logs, until I started running CyberSafe. It makes nice reports, with bar graphs, and it breaks down the statistics per user and date and time, so you can make sense of all of it.
This discussion is closed to new replies.
Sort by Trending