Logon Logoff Event: 533

Event ID 533 – Logon Failure: User Not Allowed To Logon At This Computer

When a user's attempt to logon fails because that specific account is not permitted to log on from that particular computer, event 533 is generated.

This log data provides the following information:

• User Name
• Domain
• Logon Type
• Logon Process
• Authentication Package
• Workstation Name

Additionally, in Windows Server 2003, the following information is also made available:

• Caller User Name
• Caller Domain
• Caller Logon ID
• Caller Process ID
• Transited Services
• Source Network Address
• Source Port

Why does event ID 533 need to be monitored?

• To detect brute-force, dictionary, and other password guess attacks.
• To detect abnormal and possibly malicious internal activity.
• To come up with a benchmark for the account lockout threshold policy.
• To ensure compliance with regulatory mandates.

Pro Tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks logon failures, helping you meet your security, operational, and compliance needs with absolute ease.