I decided to battle a few lingering problems with one of my SBS 2003 servers today and thought I might share with you my results. One of the symptoms was a very high number, over 25,000 to be exact, of Event 537 in the Security log. The exact error I got was below:
Logon Failure:
Reason:
An error occurred during logon
User Name: ***
Domain: ***
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC00002EE
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
This was weird to me since it did not show any other info other than the username and domain. After reading a few articles online, I came across this one that stated to check to see if there were any HP printer management packages installed on the pc. I thought how odd because most of the errors I was reading about said to check the net time, but I checked it out on the machine that user was logged into and sure enough there was an HP Document management tool running in the tray. Turns out it was for a printer that was no longer in service. It seems this issue can be caused if there are applications from client computers trying to logon by incorrect accounts and password. So I removed the application and rebooted the pc and so far there are no more events in the Security log.
The link to the newsgroup I got this from is here. I hope this helps someone out there.
