Event ID: 537 Kerberos Authz

[bigboy]

We are using a machine which has Windows Server 2003 with service pack 1 installed and it functions as a SQL server. When we checked in the event log then there were too many entries like below:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 1/10/2007
Time: 10:21:01 AM
User: NT AUTHORITY\SYSTEM
Computer: ******
Description:
Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: ******
Status code: 0xC000005E
Substatus code: 0x0
Caller User Name: <username>
Caller Domain: <machine name>
Caller Logon ID: (0x0,0x****)
Caller Process ID: 1888
Transited Services: -
Source Network Address: -
Source Port: -

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp. - that said
SE_AUDITID_UNSUCCESSFUL_LOGON

Can anyone tell me how to solve this problem?

[vshori]

This event may be logged when no logons have been cached for the user account, and the Interactive logon: Number of previous logons to cache (in case domain controller is not available) policy setting is set to 0 (zero). So, therefore you can safely ignore this event. For more information visit this website - http://support.microsoft.com/kb/908355

[bigboy]

The account that is getting this kind of error code is not a domain account and it is just a local machine account, so how does this thing effect the issue. Thank you for the replies.

[Coolestman]

This problem occurs because Winlogon.exe incorrectly tries a cached logon process for the user who is logging on to the local computer. To resolve this problem, obtain the latest service pack for Microsoft Windows XP. A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. More information here - http://support.microsoft.com/kb/327889