That's pretty interesting.. You'll notice that it's the Local System account that's trying to "log in". That's most likely a service that's configured to run as "LocalSystem". What other event errors are you seeing? Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/authors/harrison/ Read the books! ----- Original Message ----- From: "Steve Bostedor" <Steveb@xxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Thursday, April 11, 2002 10:06 AM Subject: [isalist] Event ID 534 http://www.ISAserver.org I keep getting this on the ISA server: ================================================================== Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 534 Date: 4/9/2002 Time: 2:59:34 PM User: NT AUTHORITY\SYSTEM Computer: ISASERVER Description: Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: Domain: Logon Type: 3 Logon Process: Kerberos Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: - ==================================================================== Does anyone know why this would be happening? To the best of my knowledge, no one is attempting to log into the server. ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')