Event : 537 - Blank user name Expand / Collapse
Author
Message
Posted 12/15/2009 1:05:13 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/15/2009 1:01:13 AM
Posts: 1, Visits: 0
On what scenario's will this event 537 will be triggered. Can any one explain me in detail.

Thanks,

Sandeep

Post #286
Posted 12/22/2009 5:37:45 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
It's just a catchall that seldom is logged.  I've only seen it when there was some kind of network or service availability problem.
Post #290
Posted 6/23/2010 5:13:40 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/23/2010 5:11:11 PM
Posts: 1, Visits: 2
Randy,
As per our discussion on the webinar today, here is some more information about 537.

Event ID 537 is a generic logon failure that most of the time that I've seen it has a blank user name, to figure out what the true underlying cause of the logon failure you need to look at the Status Code and Substatus Code in the description.  The codes that I see most often when talking to customers is:

Status code:       0xC000006D

Substatus code:                0xC0000133

These 2 codes indicate that the workstation clock is more than 5 mins out of sync with the Domain Controller.  I have put together a blog entry on how to analyze event 537 that includes links to where to look up the Status and Substatus codes; ithompson.wordpress.com/2009/02/24/analyzing-id-537-and-the-status-codes/.

Hope this info helps.

Isaac

Post #394
Posted 7/8/2010 9:11:26 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Thanks Isaac
Post #409
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:30pm