Event IDs 565, 675, 537

  • Thread starter Thread starter CAL
  • Start date Start date
C

CAL

I get Event ID 565, with symptoms as in KB Article 319672
and Event ID 675, with symptoms as in KB Article 328570,
except all my clients were added after a clean install of
SBS Server 2000 with active directory, not an upgrade.
I also get Event ID 537. I have applied SP4, with no
effect. Can anyone steer me in the right direction?
Here are samples of the events (recreated from printouts):
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: Todays date
Time: Todays time
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Pre-authentication failed:
User Name: RECEPTIONIST$
User ID: DomainName\RECEPTIONIST$
Service Name: brbtgt/DOMAINNAME.COM
Pre-Authentication Type: 0x2
Failure Code: 0x25
Client Address: 10.xx.xxx.xx


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: Todays date
Time: Todays time
User: DomainName\MJohnson
Computer: SERVERNAME
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Logon
Object Name: /o=DomainName/ou=first
administrative group/cn=Recipients/cn=MJohnson
New Handle ID: -
Operation ID: {o,722976}
Process ID: 5012
Primary User Name: SERVERNAME$
Primary Domain: DomainName
Primary Logon ID: (0x0,0x3E7)
Client User Name: MJohnson
Client Domain: DomainName
Client Logon ID: (0x0,0xB080B)
Accesses Unknown specific access (bit 8)

Priveleges

Properties:
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Send As


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: Todays date
Time: Todays time
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Logon Failure:
Reason: An unexpected error occurred
during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -


The domain and server names have been omitted. All other
info, including blanks are exactly as in the errors. The
537 and 675 have the exact same event time. The errors
are not restricted to these 2 users.

Any help would be appreciated
Thanks
CAL
 
Back
Top