SBS - Event ID 537 NTLM Logon Errors - 0x80090308 and Trend

As we go along with this problem on our client's SBS 2003 box, Trend is seemingly helpless to correct the problem.

The e-mail support was horrendous. Unfortunately, things did not work out at all.

From there, an escalation was made and we were put in touch with B. who was somewhat helpful via telephone ... though her script only went so far before we were asked to send the entire server log set to Trend.

We have not heard back since ... though it has only been since late last week.

Here is our initial post on the problem from July: SBS - Trend Worry Free Business Security Event ID 537.

We have been hearing from others about this problem on their SBS box or their client's SBS boxes too.

The error:

Security 537 2/10/2008 4:44 AM 16,044 *

Logon Failure: Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Èù
Authentication Package: NTLM
Workstation Name:
Status code: 0x80090308
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -

And, something that came to us via one person who contacted us as a result of the first post on this issue that causes us to pause:

Dear XXXXXX,
This is an update.
According to RD, the event ID 537 is caused by TMUFE, which is our Web Reputation service engine.
The behaviour of TMUFE will be as follows:

1. Connect to Proxy Server without authentication.
2. Proxy server return access denied (Event ID 537) and request authentication.
3. Connect to Proxy Server with configured user name/password.

So it is normal for the security warning to show up on event logs of the SBS server.
Thank you and have a great day!
Best regards,
Txxxx Cxxxx
Systems Engineer
Australia Technical Support Center
TrendLabs HQ, Trend Micro Incorporated

And, just tonight as this post was being written, the following showed up in our Experts-Exchange Inbox: SBS performance report displays thousands of event id 537 errors. Apparently the above note was sent to the person posing the question who has 5 SBS servers showing the problem.

The above mentioned services were indeed a part of our troubleshooting with B. Especially when it came to having ISA on the box. But, if there were authentication issues, updates too should fail which they were not.

This situation is going from bad to worse in a hurry. :(

Trend, better pull up your socks and get this fixed in a hurry, because right now we are on the edge of walking away ... as our clients that have the product installed are not impressed either ... especially this one: Trend Micro Worry Free Security is not so worry free?

ForeFront and Windows Live OneCare for Server on SBS 2008 are looking more and more attractive everyday ... with ExchangeDefender sitting in front!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.