Re: 677 events

From: Michael Bednarek (mb_at_tgm.com.au)
Date: 04/29/03 

Date: Tue, 29 Apr 2003 07:06:03 GMT

On Tue, 29 Apr 2003 09:06:05 +0700, Peter K. <pmkdatabase@yahoo.ca>
wrote in microsoft.public.win2000.security:

>Any ideas what is causing these in the middle of the night in an empty
>office?
>
>Thanks,
>
>Peter Kaufman MCP
>
>Event Type: Failure Audit
>Event Source: Security
>Event Category: Account Logon
>Event ID: 677
>Date: 4/29/2003
>Time: 4:30:28 AM
>User: NT AUTHORITY\SYSTEM
>Computer: PMCI-01
>Description:
>Service Ticket Request Failed:
> User Name: ACCOUNTING2$
> User Domain: JOMTIEN.PMCI.NET
> Service Name: krbtgt/JOM.PMCI.NET
> Ticket Options: 0x2
> Failure Code: 0x20
> Client Address: 192.168.100.206

Kerberos tickets expire. Apparently, this is normal. Switch off
auditing Account Logon Failures. This seemed unsatisfactory to me,
too, but seems to be the only way out. Trustworthy computing! 

-- 
Michael Bednarek, IT Manager, Tactical Global Management
Waterfront Pl, Brisbane 4000, Australia. "POST NO BILLS"
http://mcmbednarek.tripod.com/