Event ID 533 – Logon Failure: User Not Allowed To Logon At This Computer
|Description||Logon failure – User not allowed to logon at this computer|
When a user's attempt to logon fails because that specific account is not permitted to log on from that particular computer, event 533 is generated.
This log data provides the following information:
- User Name
- Logon Type
- Logon Process
- Authentication Package
- Workstation Name
Additionally, in Windows Server 2003, the following information is also made available:
- Caller User Name
- Caller Domain
- Caller Logon ID
- Caller Process ID
- Transited Services
- Source Network Address
- Source Port
Why does event ID 533 need to be monitored?
- To detect brute-force, dictionary, and other password guess attacks.
- To detect abnormal and possibly malicious internal activity.
- To come up with a benchmark for the account lockout threshold policy.
- To ensure compliance with regulatory mandates.
With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks logon failures, helping you meet your security, operational, and compliance needs with absolute ease.
Event 533 applies to the following operating systems:
- Windows Server 2000
- Windows 2003 and XP
Corresponding event ID in Windows 2008 and Windows Vista is 4625