Windows Security Log Event ID 536

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryLogon/Logoff
Type Failure
Corresponding events
in Windows 2008
and Vista		 4625  

536: Logon Failure - The NetLogon component is not active

On this page

Event 536 has not been observed.

Free Security Log Resources by Randy

Description Fields in 536

  • User Name:
  • Domain:
  • Logon Type:
  • Logon Process:
  • Authentication Package:
  • Workstation Name:

The following fields are added in Windows Server 2003:

  • Caller User Name:
  • Caller Domain:
  • Caller Logon ID:
  • Caller Process ID:
  • Transited Services:
  • Source Network Address:

Supercharger Free Edition

 

Examples of 536

Reason: The NetLogon component is not active

User Name: %1
Domain: %2
Logon Type: %3
Logon Process: %4
Authentication Package: %5
Workstation Name: %6

Windows Server 2003 adds these fields:

Caller User Name:-
Caller Domain:-
Caller Logon ID:-
Caller Process ID:-
Transited Services:-
Source Network Address:10.42.42.180
Source Port:0

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



Mini-Seminars Covering Event ID 536
Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
Additional Resources