http://www.eventid.net/display.asp?eventid=537&source=

If you are getting event errors 537 and throwing off Kerberos errors, ensure that your clients are time sync’d with the domain controller. 

http://www.smallbizserver.net/DesktopDefault.aspx?tabid=64

 

 

10 Responses to Getting an event 537 in your Error logs?

  1. David Schrag says:

    The link appears to be broken. I get "DotNetNuke Configuration Error …

    Domain Name "www.smallbizserver.net/sbs2000" Does Not Exist In The Database"

  2. Susan says:

    Thanks…she moved the page!

  3. Ian Painter says:

    Susan,

    The link is still dead, however, MS have some detail on this problem.

    http://support.microsoft.com/?kbid=327889

    We have a related issue to the above but I’m not sure its the same. About 20-30 times a day we get 531 in our event logs. All our client machines are patched to SP2 and IP show that this comes from our win2003 server connected to our SBS2003. Is there something I need to do to the Win2003 Server to stop this happening? Also why is there no UserName?

    Reason: An error occurred during logon

    User Name:

    Domain:

    Logon Type: 3

    Logon Process: Kerberos

    Authentication Package: Kerberos

    Workstation Name: –

    Status code: 0xC000006D

    Substatus code: 0xC0000133

    Caller User Name: –

    Caller Domain: –

    Caller Logon ID: –

    Caller Process ID: –

    Transited Services: –

    Source Network Address: 192.168.1.27

    Source Port: 4910

    Any ideas?

    Thanks – Ian

  4. Jason Wilson says:

    We have the same issue. We are running AD 2003 in Native. We see hundreds of these events in our security logs and I have manually checked and the time seems always to be in synch even though 0xC0000133 translates to NT_STATUS_TIME_DIFFERENCE_AT_DC. Help?

  5. Susan says:

    Manually the same isn’t the same as really the same. Have the server be the official time keeper and sync them up with the server.

  6. Luke says:

    I’m getting a huge amount of these after upgrading from ISA 2000 to ISA 2004. The latest server admin report had 23,319 of them in the middle of the night outside of office hours. Any ideas?

    Luke

  7. Rich says:

    Anyone figure this out, I’m in the same boat. I even added a login script to ensure they synch on login and it did not help. This is a pain to see 6000+ of these in my logs.

  8. Jonathan says:

    I’m getting the same 531 errors as above. Did anyone figure this out?

  9. EdPryor says:

    Is there a solution to this that anyone knows about? Thanks, Ed

  10. bradley says:

    Yes …ensure your clients are time sync’d to the server… or remove

    1. HP printer software that has a monitor component
    2. NIC helper software