A Service Control Manager (SCM) event cannot be logged in the System event log on a Windows Server 2003-based computer

A Service Control Manager (SCM) event cannot be logged in the System event log on a Windows Server 2003-based computer when the following conditions are true:

• You apply Windows Server 2003 Service Pack 1 or Service Pack 2 on this computer.
• You run the Sysprep.exe command on this computer, or you run the Active Directory Installation Wizard (Dcpromo.exe) on this computer.

Additionally, if you enable the Audit logon events local policy on the computer, the following event ID error message is logged in the Security log:

Event Type: Failure Audit
Event Source: Security
Event ID: 537
Description:
Logon Failure:
Reason: An error occurred during logon
Authentication Package: Kerberos
Status code: 0xC000040A

This issue occurs when the user who is logged on is not the user who is registered in the Windows Management Instrumentation (WMI) repository. WMI will not allow for events to be written to the System event log if the user who is logged on is not registered in the WMI repository.

To work around this issue, follow these steps:

1. Click Start, click Run, type control panel, and then click OK.
2. Double-click Scheduled Tasks, click Advanced, and then click AT Service Account.
3. In the AT Service Account Configuration dialog box, select System Account.
4. Click Start, click Run, type cmd, and then click OK.
5. At the command prompt, type the following command:
   AT 12:00/i mofcomp %windir%\system32\wbem\scm.mof
   
   
   Note This step re-compiles the Scm.mof file.
   
   Note The AT command schedules commands and programs to run on a computer at a specified time and date, such as /every: date[2005:05:16:12:00:00]. You can run the /every: date[...] command on each specified day of the week or month. If the date is omitted, the current day of the month is assumed. The Schedule service must be running to use the AT command. The /i switch allows for the job to interact with the desktop of the user who is logged on when the job runs.
6. Close the command prompt, and then restart the computer.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.