Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

our server is running 2003 R2 X64 SP2, we keep seeing this in clusters of around 4 rapid fire. Sometimes 2 hours, sometimes around 8 hours apart with slight variations. I am also seeing the same blank username and domain in an account locked out message, I have tried disabling all scheduled tasks, if anyone has any idea please let me know! I find these processes running out of svc host:

AeLookupSvc, AppMgmt, BITS, Browser, CryptSvc, dmserver, EventSystem, helpsvc, IAS, lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, winmgmt, wuauserv, WZCSVC

Logon Failure: Reason: Account currently disabled
User Name:

Logon Type: 3
Logon Process: Authz

Authentication Package: Kerberos
Workstation Name: PPCLUBES_TS
Caller User Name: PPCLUBES_TS$
Caller Domain: PPCLUBES
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 928
Transited Services: -
Source Network Address: -
Source Port: -

share|improve this question
What is PPCLUBES_TS? the server that the event is being logged on? – Richard Slater Dec 16 '09 at 19:57
yes that is the server we are logging with. – Az. Dec 16 '09 at 21:26
up vote 0 down vote accepted

From what I can gather and assuming that PPCLUBES_TS is the name of the server that the message is being logged on if a service is attempting to log on with the built-in SYSTEM account.

Try the following:

  1. Stop the WMI Service

    net stop winmgmt

  2. Wait to see if the Event recurs

If this seems to solve the problem you can re-compile the SCM.mof

  1. From a cmd prompt enter the following (replace 00:00 with a time a few minutes from now):

    at 00:00 /interactive cmd.exe

  2. When a new cmd prompt starts switch to it

  3. Change directory to C:\Windows\System32\wbem
  4. Execute the following command

    mofcomp scm.mof

  5. Start/Restart the WMI service

    net start winmgmt

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.