EventID 534: User has not been granted requested logon type

Archived from groups: microsoft.public.win2000.security (More info?)

In general I'm familiar with Event ID 534, which is a Security Eventviewer
log message that indicates that "the user has not been granted the requested
logon type at this machine". What is confusing me is that I frequently
see these eventids with a logon type of 3 (network logon) where the username
and domain are *blank*. Workstation name is also blank. I thought
that this might be an anonymous logon request, but what is all the more
perplexing is that the logon process is Kerberos.

What are the possible sources of such a request?

--
Will
4 answers Last reply
More about eventid user granted requested logon type
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    There was a problem with this on XP Pro computers if that is where you are
    seeing them as shown in the link below. --- Steve

    http://support.microsoft.com/?kbid=841399

    "Will" <DELETE_westes@earthbroadcast.com> wrote in message
    news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
    > In general I'm familiar with Event ID 534, which is a Security Eventviewer
    > log message that indicates that "the user has not been granted the
    > requested
    > logon type at this machine". What is confusing me is that I frequently
    > see these eventids with a logon type of 3 (network logon) where the
    > username
    > and domain are *blank*. Workstation name is also blank. I thought
    > that this might be an anonymous logon request, but what is all the more
    > perplexing is that the logon process is Kerberos.
    >
    > What are the possible sources of such a request?
    >
    > --
    > Will
    >
    >
    >
  2. Archived from groups: microsoft.public.win2000.security (More info?)

    I see these messages on Windows 2000 Server SP4, and we have no XP clients
    in our environment. Other ideas?

    --
    Will


    "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
    news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl...
    > There was a problem with this on XP Pro computers if that is where you are
    > seeing them as shown in the link below. --- Steve
    >
    > http://support.microsoft.com/?kbid=841399
    >
    > "Will" <DELETE_westes@earthbroadcast.com> wrote in message
    > news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
    > > In general I'm familiar with Event ID 534, which is a Security
    Eventviewer
    > > log message that indicates that "the user has not been granted the
    > > requested
    > > logon type at this machine". What is confusing me is that I
    frequently
    > > see these eventids with a logon type of 3 (network logon) where the
    > > username
    > > and domain are *blank*. Workstation name is also blank. I thought
    > > that this might be an anonymous logon request, but what is all the more
    > > perplexing is that the logon process is Kerberos.
    > >
    > > What are the possible sources of such a request?
    > >
    > > --
    > > Will
    > >
    > >
    > >
    >
    >
  3. Archived from groups: microsoft.public.win2000.security (More info?)

    Not offhand Will. I will look around and post back if I find anything. ---
    Steve


    "Will" <DELETE_westes@earthbroadcast.com> wrote in message
    news:z_GdnaSuJZX7CeTfRVn-1A@giganews.com...
    >I see these messages on Windows 2000 Server SP4, and we have no XP clients
    > in our environment. Other ideas?
    >
    > --
    > Will
    >
    >
    > "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
    > news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl...
    >> There was a problem with this on XP Pro computers if that is where you
    >> are
    >> seeing them as shown in the link below. --- Steve
    >>
    >> http://support.microsoft.com/?kbid=841399
    >>
    >> "Will" <DELETE_westes@earthbroadcast.com> wrote in message
    >> news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
    >> > In general I'm familiar with Event ID 534, which is a Security
    > Eventviewer
    >> > log message that indicates that "the user has not been granted the
    >> > requested
    >> > logon type at this machine". What is confusing me is that I
    > frequently
    >> > see these eventids with a logon type of 3 (network logon) where the
    >> > username
    >> > and domain are *blank*. Workstation name is also blank. I
    >> > thought
    >> > that this might be an anonymous logon request, but what is all the more
    >> > perplexing is that the logon process is Kerberos.
    >> >
    >> > What are the possible sources of such a request?
    >> >
    >> > --
    >> > Will
    >> >
    >> >
    >> >
    >>
    >>
    >
    >
  4. Archived from groups: microsoft.public.win2000.security (More info?)

    turn on netlogon logging to get more detail the next time it happens..

    Location of the log file - %windir%\debug

    Command Prompt setting - Enable from command prompt with "NLTEST
    /DBFlag:2080FFFF"

    Registry Location -
    HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

    Registry Setting - Add the REG_SZ value "DBFlag" and set it to
    0x02080fff

    --
    Glenn L
    CCNA, MCSE 2000/2003 + Security

    "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
    news:OCyQtZZUFHA.228@TK2MSFTNGP12.phx.gbl...
    > Not offhand Will. I will look around and post back if I find
    > nything. --- Steve
    >
    >
    > "Will" <DELETE_westes@earthbroadcast.com> wrote in message
    > news:z_GdnaSuJZX7CeTfRVn-1A@giganews.com...
    >>I see these messages on Windows 2000 Server SP4, and we have no XP clients
    >> in our environment. Other ideas?
    >>
    >> --
    >> Will
    >>
    >>
    >> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
    >> news:ucmOLsMUFHA.1432@TK2MSFTNGP09.phx.gbl...
    >>> There was a problem with this on XP Pro computers if that is where you
    >>> are
    >>> seeing them as shown in the link below. --- Steve
    >>>
    >>> http://support.microsoft.com/?kbid=841399
    >>>
    >>> "Will" <DELETE_westes@earthbroadcast.com> wrote in message
    >>> news:%23ykmvY5TFHA.4092@TK2MSFTNGP12.phx.gbl...
    >>> > In general I'm familiar with Event ID 534, which is a Security
    >> Eventviewer
    >>> > log message that indicates that "the user has not been granted the
    >>> > requested
    >>> > logon type at this machine". What is confusing me is that I
    >> frequently
    >>> > see these eventids with a logon type of 3 (network logon) where the
    >>> > username
    >>> > and domain are *blank*. Workstation name is also blank. I
    >>> > thought
    >>> > that this might be an anonymous logon request, but what is all the
    >>> > more
    >>> > perplexing is that the logon process is Kerberos.
    >>> >
    >>> > What are the possible sources of such a request?
    >>> >
    >>> > --
    >>> > Will
    >>> >
    >>> >
    >>> >
    >>>
    >>>
    >>
    >>
    >
    >
Ask a new question

Read More

Security Microsoft Windows