| Event Id | 536 |
| Source | Security |
| Description | Logon Failure: Reason: The NetLogon component is not active User Name: <User Name> Domain: <Domain> Logon Type: <Logon Type> Logon Process: <Logon Process> Authentication Package: <Authentication Package> Workstation Name: <Workstation Name> |
| Event Information | Cause: This event record indicates that a logon attempt was made and rejected because the Net Logon service was not running. The Net Logon service supports pass-through authentication of account log ons and is used when the workstation participates in a domain. This is a significant error that should be immediately investigated. |
| Reference Links | Alternate Event ID in Vista and Windows Server 2008 is 4625. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.