Logon Failure Events

This report provides a list of the logon failure events. The report includes the following events from the Security event log:

• 529—Unknown user name or bad password
• 530—Account logon time restriction violation
• 531—Account currently disabled
• 532—The specified user account has expired
• 533—User not allowed to log on at this computer
• 534—The user has not been granted the requested logon type at this machine
• 535—The password for the specified account has expired
• 536—The NetLogon component is not active
• 537—An unexpected error occurred during logon
• 539—Account locked out
• 548—Domain security ID inconsistent

The columns of this report are defined as follows:

User Account

Specifies the name of the user account that had the logon failure.

Event Time

Specifies the time of the logon failure.

Server

Specifies the name of the server where the logon failure occurred.

Event #

Specifies the event number.

Reason For Failure

Specifies the reason for failure.