UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 537 - Logon failure - The logon attempt failed for other reasons. / Event : 537 - Blank user name / Latest Posts

RE: Event : 537 - Blank user name

RandyFranklinSmith — Thu, 08 Jul 2010 09:11:26 GMT

Thanks Isaac

RE: Event : 537 - Blank user name

Isaac — Wed, 23 Jun 2010 17:13:40 GMT

Randy,
As per our discussion on the webinar today, here is some more information about 537.

Event ID 537 is a generic logon failure that most of the time that I've seen it has a blank user name, to figure out what the true underlying cause of the logon failure you need to look at the Status Code and Substatus Code in the description. The codes that I see most often when talking to customers is:

Status code: 0xC000006D

Substatus code: 0xC0000133

These 2 codes indicate that the workstation clock is more than 5 mins out of sync with the Domain Controller. I have put together a blog entry on how to analyze event 537 that includes links to where to look up the Status and Substatus codes; ithompson.wordpress.com/2009/02/24/analyzing-id-537-and-the-status-codes/.

Hope this info helps.

Isaac

RE: Event : 537 - Blank user name

RandyFranklinSmith — Tue, 22 Dec 2009 05:37:45 GMT

It's just a catchall that seldom is logged. I've only seen it when there was some kind of network or service availability problem.

Event : 537 - Blank user name

guggilamsandeep — Tue, 15 Dec 2009 01:05:13 GMT

On what scenario's will this event 537 will be triggered. Can any one explain me in detail.

Thanks,

Sandeep