Logon Failure with empty user name and domain

Discuss Windows Event Log events. What they mean, what they tell you about your machine's security ... and whatever questions else you have.

Moderator: alorbach

Google Ads


Logon Failure with empty user name and domain

Postby GoblinQueen » Thu Aug 03, 2006 2:57 pm

I hope someone can help me with this - I can't find any info out there!
I have a series of logon failure recorded to one of the File+Print servers on my mixed-mode W2K3 domain (2000/XP clients).

Event ID 539
Logon Failure
Reason: Account locked out
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: FILESERVER$
Caller User Name: FILESERVER$
Caller Domain: <snipped - but the domain name was correct>

I don't understand why the User Name and Domain fields are blank! Also, if the logon failed due to the account being locked out, what account object was referenced? If an account doesn't exist (username blank) how can it be locked out?

I would like to get to the bottom of this, as it has me stumped.
GoblinQueen
New
 
Posts: 3
Joined: Thu Aug 03, 2006 2:51 pm

Google Ads


Return to Windows Events

Who is online

Users browsing this forum: No registered users and 1 guest

cron