Re: Event ID 534

  • From: "Jim Harrison" <jim@xxxxxxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Thu, 11 Apr 2002 22:11:54 -0700

That's pretty interesting..
You'll notice that it's the Local System account that's trying to "log in".
That's most likely a service that's configured to run as "LocalSystem".
What other event errors are you seeing?

Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/authors/harrison/
Read the books!
----- Original Message -----
From: "Steve Bostedor" <Steveb@xxxxxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Thursday, April 11, 2002 10:06 AM
Subject: [isalist] Event ID 534


http://www.ISAserver.org


I keep getting this on the ISA server:
==================================================================
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 534
Date:  4/9/2002
Time:  2:59:34 PM
User:  NT AUTHORITY\SYSTEM
Computer: ISASERVER
Description:
Logon Failure:
  Reason: The user has not been granted the requested
   logon type at this machine
  User Name:
  Domain:
  Logon Type: 3
  Logon Process: Kerberos
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: -
====================================================================

Does anyone know why this would be happening? To the best of my knowledge,
no one is attempting to log into the server.

------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')




Other related posts: