Announcement

Collapse
No announcement yet.

Event log

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Event log

    Hi all!

    We have a 5 year DC server 2003 standard which was working great (and still does)
    In event log for past 1-2 months we have this entry

    EVENT #
    866188
    EVENT LOG
    Security
    EVENT TYPE
    Audit Failure
    SOURCE
    Security
    CATEGORY
    Logon/Logoff
    EVENT ID
    537
    USERNAME
    NT AUTHORITY\SYSTEM
    COMPUTERNAME
    THIS_COMPUTER-DC

    DATE / TIME
    28.3.2012 13:26:21
    MESSAGE
    Logon Failure:
    Reason: An error occurred during logon
    User Name: -
    Domain: -
    Logon Type: 5
    Logon Process: Advapi
    Authentication Package: Negotiate
    Workstation Name: -
    Status code: 0xC00000EE
    Substatus code: 0xC00000EE
    Caller User Name: VM-DC$
    Caller Domain: OURDOMAIN
    Caller Logon ID: (0x0,0x3E7)
    Caller Process ID: 864
    Transited Services: -
    Source Network Address: -
    Source Port: -


    I was searching and searching and asking around but I found 0 solution so far.
    That PID 864 belongs to svchost.exe.

    Has anyone slightest idea what is going on here?
    I really don`t know what/where can I search for more info that would bring me to cause of this log entry...

    Thanks a bunch!

  • #2
    Re: Event log

    I forgot to mention...
    It happens every 10 minutes...

    Comment


    • #3
      Re: Event log

      Using procmon I finally found out which service is giving me trouble...
      It is:
      Windows Management Instrumentation - WMI

      Any idea what can I do to stop events from poping up?
      If I restart server error goes away and returns randomly...

      Comment

      Working...
      X