Logon Logoff Event: 536

Event ID 536 – Logon Failure: NetLogon component is not active

Event 536 is generated when a logon attempt was rejected because the NetLogon service was not running. The NetLogon service is used to authenticate account logons that pass through when a workstation participates in a domain.

This log data provides the following information:

• User Name
• Domain
• Logon Type
• Logon Process
• Authentication Package
• Workstation Name

Additionally, in Windows Server 2003, the following information is also made available:

• Caller User Name
• Caller Domain
• Caller Logon ID
• Caller Process ID
• Transited Services
• Source Network Address

Why does event ID 536 need to be monitored?

• To detect brute-force, dictionary, and other password guess attacks.
• To detect abnormal and possibly malicious internal activity.
• To come up with a benchmark for the account lockout threshold policy.
• To ensure compliance with regulatory mandates.

Pro Tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks logon failures, helping you meet your security, operational, and compliance needs with absolute ease.