Logon Logoff Event: 537

Event ID 537 – Logon Failure: Logon Attempt Failed For Other Reasons

Event 537 is generated when a logon attempt was rejected due to a reason not mentioned explicitly in audit records. It is considered an unexpected logon error.

This log data provides the following information:

• User Name
• Domain
• Logon Type
• Logon Process
• Authentication Package
• Workstation Name

Additionally, in Windows Server 2003, the following information is also made available:

• Caller User Name
• Caller Domain
• Caller Logon ID
• Caller Process ID
• Transited Services
• Source Network Address
• Source Port

Why does event ID 537 need to be monitored?

• To detect brute-force, dictionary, and other password guess attacks.
• To detect abnormal and possibly malicious internal activity.
• To come up with a benchmark for the account lockout threshold policy.
• To ensure compliance with regulatory mandates.

Pro Tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks logon failures, helping you meet your security, operational, and compliance needs with absolute ease.