Sign in with
Sign up | Sign in
Your question

EventID 534: User has not been granted requested logon type

Last response: in Windows 2000/NT
Share
Anonymous
a b 8 Security
May 3, 2005 1:11:28 AM

Archived from groups: microsoft.public.win2000.security (More info?)

In general I'm familiar with Event ID 534, which is a Security Eventviewer
log message that indicates that "the user has not been granted the requested
logon type at this machine". What is confusing me is that I frequently
see these eventids with a logon type of 3 (network logon) where the username
and domain are *blank*. Workstation name is also blank. I thought
that this might be an anonymous logon request, but what is all the more
perplexing is that the logon process is Kerberos.

What are the possible sources of such a request?

--
Will
Anonymous
a b 8 Security
May 4, 2005 4:04:27 PM

Archived from groups: microsoft.public.win2000.security (More info?)

There was a problem with this on XP Pro computers if that is where you are
seeing them as shown in the link below. --- Steve

http://support.microsoft.com/?kbid=841399

"Will" <DELETE_westes@earthbroadcast.com> wrote in message
news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
> In general I'm familiar with Event ID 534, which is a Security Eventviewer
> log message that indicates that "the user has not been granted the
> requested
> logon type at this machine". What is confusing me is that I frequently
> see these eventids with a logon type of 3 (network logon) where the
> username
> and domain are *blank*. Workstation name is also blank. I thought
> that this might be an anonymous logon request, but what is all the more
> perplexing is that the logon process is Kerberos.
>
> What are the possible sources of such a request?
>
> --
> Will
>
>
>
Anonymous
a b 8 Security
May 5, 2005 12:35:01 AM

Archived from groups: microsoft.public.win2000.security (More info?)

I see these messages on Windows 2000 Server SP4, and we have no XP clients
in our environment. Other ideas?

--
Will


"Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl...
> There was a problem with this on XP Pro computers if that is where you are
> seeing them as shown in the link below. --- Steve
>
> http://support.microsoft.com/?kbid=841399
>
> "Will" <DELETE_westes@earthbroadcast.com> wrote in message
> news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
> > In general I'm familiar with Event ID 534, which is a Security
Eventviewer
> > log message that indicates that "the user has not been granted the
> > requested
> > logon type at this machine". What is confusing me is that I
frequently
> > see these eventids with a logon type of 3 (network logon) where the
> > username
> > and domain are *blank*. Workstation name is also blank. I thought
> > that this might be an anonymous logon request, but what is all the more
> > perplexing is that the logon process is Kerberos.
> >
> > What are the possible sources of such a request?
> >
> > --
> > Will
> >
> >
> >
>
>
Related resources
Anonymous
a b 8 Security
May 5, 2005 4:20:26 PM

Archived from groups: microsoft.public.win2000.security (More info?)

Not offhand Will. I will look around and post back if I find anything. ---
Steve


"Will" <DELETE_westes@earthbroadcast.com> wrote in message
news:z_GdnaSuJZX7CeTfRVn-1A@giganews.com...
>I see these messages on Windows 2000 Server SP4, and we have no XP clients
> in our environment. Other ideas?
>
> --
> Will
>
>
> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
> news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl...
>> There was a problem with this on XP Pro computers if that is where you
>> are
>> seeing them as shown in the link below. --- Steve
>>
>> http://support.microsoft.com/?kbid=841399
>>
>> "Will" <DELETE_westes@earthbroadcast.com> wrote in message
>> news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
>> > In general I'm familiar with Event ID 534, which is a Security
> Eventviewer
>> > log message that indicates that "the user has not been granted the
>> > requested
>> > logon type at this machine". What is confusing me is that I
> frequently
>> > see these eventids with a logon type of 3 (network logon) where the
>> > username
>> > and domain are *blank*. Workstation name is also blank. I
>> > thought
>> > that this might be an anonymous logon request, but what is all the more
>> > perplexing is that the logon process is Kerberos.
>> >
>> > What are the possible sources of such a request?
>> >
>> > --
>> > Will
>> >
>> >
>> >
>>
>>
>
>
Anonymous
a b 8 Security
May 7, 2005 4:52:10 AM

Archived from groups: microsoft.public.win2000.security (More info?)

turn on netlogon logging to get more detail the next time it happens..

Location of the log file - %windir%\debug

Command Prompt setting - Enable from command prompt with "NLTEST
/DBFlag:2080FFFF"

Registry Location -
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Registry Setting - Add the REG_SZ value "DBFlag" and set it to
0x02080fff

--
Glenn L
CCNA, MCSE 2000/2003 + Security

"Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
news:o CyQtZZUFHA.228@TK2MSFTNGP12.phx.gbl...
> Not offhand Will. I will look around and post back if I find
> nything. --- Steve
>
>
> "Will" <DELETE_westes@earthbroadcast.com> wrote in message
> news:z_GdnaSuJZX7CeTfRVn-1A@giganews.com...
>>I see these messages on Windows 2000 Server SP4, and we have no XP clients
>> in our environment. Other ideas?
>>
>> --
>> Will
>>
>>
>> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
>> news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl...
>>> There was a problem with this on XP Pro computers if that is where you
>>> are
>>> seeing them as shown in the link below. --- Steve
>>>
>>> http://support.microsoft.com/?kbid=841399
>>>
>>> "Will" <DELETE_westes@earthbroadcast.com> wrote in message
>>> news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
>>> > In general I'm familiar with Event ID 534, which is a Security
>> Eventviewer
>>> > log message that indicates that "the user has not been granted the
>>> > requested
>>> > logon type at this machine". What is confusing me is that I
>> frequently
>>> > see these eventids with a logon type of 3 (network logon) where the
>>> > username
>>> > and domain are *blank*. Workstation name is also blank. I
>>> > thought
>>> > that this might be an anonymous logon request, but what is all the
>>> > more
>>> > perplexing is that the logon process is Kerberos.
>>> >
>>> > What are the possible sources of such a request?
>>> >
>>> > --
>>> > Will
>>> >
>>> >
>>> >
>>>
>>>
>>
>>
>
>
!