Hello All,
I am facing very strange issue in our environment, we have WinNT Domain called CL on which account “abc” is created, we have External Trust (In/Out) in place with this domain and the Windows 2003 Domain called WL.
There is one application which is installed on server WL0004, this server is joined to Windows 2003 domain (WL), but for some reason application is using NT Domain account “CL\abc” to start some activities, users are using the application by login into WL0004 server but now users facing issue while starting the application and their application is not starting, below event are getting generated on WL0004 where application is installed.
========================================================================
Source – Security, Event ID 537, User NT AUTHORITY\SYSTEM
Logon Failure:
Reason: An error occurred during logon
User Name: abc
Domain: CL
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: WL0004
Status code: 0xC000005E
Substatus code: 0x0
Caller User Name: WL0004$
Caller Domain: WL
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 3124
Transited Services: -
Source Network Address: -
Source Port:
========================================================================
-
We then changed some WINS entries and rebooted the server but again after few days issue occurred, now we are not sure that if this is WINS issue....
When we rebooted the server issue resolved and then below successful login/logoff event on generated on WL0004.
========================================================================
Source : Security, Event Id 552, User : NT AUTHORITY\SYSTEM
Logon attempt using explicit credentials:
Logged on user:
User Name: WL0004$
Domain: WL
Logon ID: (0x0,0x3E7)
Logon GUID: -
User whose credentials were used:
Target User Name: abc
Target Domain:CL
Target Logon GUID: -
Target Server Name: localhost
Target Server Info: localhost
Caller Process ID: 3120
Source Network Address: -
Source Port: -
========================================================================
========================================================================
Source : Security, Event Id 540, User CL\ABC
Successful Network Logon:
User Name: ABC
Domain: CL
Logon ID: (0x0,0x774CC41)
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: WL0004
Logon GUID: -
Caller User Name: WL0004$
Caller Domain: WL
Caller Logon ID:(0x0,0x3E7)
Caller Process ID: 3120
Transited Services: -
Source Network Address: -
Source Port: -
========================================================================
Could someone suggest on troubleshooting steps please.
MCP, MCTS