Hi,

I get hundereds of event ID 537 during daytime in the security log of our
SBS Server 2003 (german version) with the statuscode 0x80090308 and
substatuscode 0x0. A search with google gave me some hints, that this
problem could be related to Trend Micro Worry Free Business Security 6.0.
The solutions provided did not helpyet. I did a fresh install of the trend
WFBS 6.0 last weekend without success. Could you please help me, how I could
pinpoint the workstation and the service causing the problem? The eventlog
does not show which workstation or service is causing the faild login. I am
even not shure if Trend Micro is the real problem.

Virus should not be the source of the problem. We did a scan of every
workstations with third party antivirus software, just to exclude it. The
problem starts during daytime, when the employees start to work and ends in
the evening. So I concluded the problem might be a workstation. The error
repeats itself every few minutes in bursts of say 5 to 6 attempts. This
gives me about 7'000 entries in the security log a day.

Any hints how to pinpoint the culprit workstation an service will be highly
appreciated

Regards
Simon





Ereignistyp: Fehlerüberw.
Ereignisquelle: Security
Ereigniskategorie: An-/Abmeldung
Ereigniskennung: 537
Datum: 06.11.2009
Zeit: 08:27:49
Benutzer: NT-AUTORITÄT\SYSTEM
Computer: SERVER
Beschreibung:
Fehlgeschlagene Anmeldung:
Grund: Während der Anmeldung ist ein Fehler aufgetreten.
Benutzername:
Domäne:
Anmeldetyp: 3
Anmeldevorgang: 
Authentifizierungspaket: NTLM
Name der Arbeitsstation:
Statuscode: 0x80090308
Substatuscode: 0x0
Aufruferbenutzername: -
Aufruferdomäne: -
Aufruferanmeldekennung: -
Aufruferprozesskennung: -
Übertragene Dienste: -
Quellnetzwerkadresse: -
Quellport: -


Weitere Informationen über die Hilfe- und Supportdienste erhalten Sie unter
http://go.microsoft.com/fwlink/events.asp.