Logon failure with status code 0xC00002EE

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I found 20 Failure audit (Source: Security, EventID: 537) events within 1
minute
Logon Failure:
Reason: An error occurred during logon
User Name: tomas
Domain: JT
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC00002EE
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
What does Logon Type 3 mean (is it interactive logon, network logon or etc.)?
And what does status code 0xC00002EE mean?
 
I found in ntstatus.h file this:
<...>
// MessageId: STATUS_UNFINISHED_CONTEXT_DELETED
//
// MessageText:
//
// A security context was deleted before the context was completed. This
is considered a logon failure.
//
#define STATUS_UNFINISHED_CONTEXT_DELETED ((NTSTATUS)0xC00002EEL)
<...>
Is this what I'm looking for? If its is, then how can I now what context was
deleted and should I be worried about it?
 
Back
Top