Re: 677 events

From: Peter Kaufman (pmkdatabase_at_yahoo.ca)
Date: 05/03/03 

Date: Sat, 03 May 2003 13:30:20 +0700

Sorry for the delay in responding. Yes, Windows 2000 SP3 is installed
- native domain. There is no such key in the registry in HKLM. There
is no parameters key under
HKLM\Services\CurrentControlSet\Services\Kdc, only Enum and Security.

Also, I did a search of the whole registry on two different DCs for
AuditSpn = no hits

Thanks,

Peter Kaufman MCP

On Tue, 29 Apr 2003 20:23:08 -0700, "Romain Niccoli [MSFT]"
<romain@online.microsoft.com> wrote:

>Have you installed windows 2000 SP3 on this machine? These
>events were disabled by default in SP3. Check out
>http://support.microsoft.com/default.aspx?scid=kb;en-
>us;302879
>
>(They can be re-enabled by setting the registry key
>HKLM\CurrentControlSet\Services\Kdc\Parameters\AuditSpn to
>1)
>
>Romain.
>
>This posting is provided "AS IS" with no warranties, and
>confers no rights. Please do not send email directly to
>this alias. This alias is for newsgroup purposes only.
>
>>-----Original Message-----
>>On Tue, 29 Apr 2003 09:06:05 +0700, Peter K.
><pmkdatabase@yahoo.ca>
>>wrote in microsoft.public.win2000.security:
>>
>>>Any ideas what is causing these in the middle of the
>night in an empty
>>>office?
>>>
>>>Thanks,
>>>
>>>Peter Kaufman MCP
>>>
>>>Event Type: Failure Audit
>>>Event Source: Security
>>>Event Category: Account Logon
>>>Event ID: 677
>>>Date: 4/29/2003
>>>Time: 4:30:28 AM
>>>User: NT AUTHORITY\SYSTEM
>>>Computer: PMCI-01
>>>Description:
>>>Service Ticket Request Failed:
>>> User Name: ACCOUNTING2$
>>> User Domain: JOMTIEN.PMCI.NET
>>> Service Name: krbtgt/JOM.PMCI.NET
>>> Ticket Options: 0x2
>>> Failure Code: 0x20
>>> Client Address: 192.168.100.206
>>
>>Kerberos tickets expire. Apparently, this is normal.
>Switch off
>>auditing Account Logon Failures. This seemed
>unsatisfactory to me,
>>too, but seems to be the only way out. Trustworthy
>computing!
>>
>>--
>>Michael Bednarek, IT Manager, Tactical Global Management
>>Waterfront Pl, Brisbane 4000, Australia. "POST NO BILLS"
>>http://mcmbednarek.tripod.com/
>>.
>>

Relevant Pages

  • Re: autoruns mistake
    ... If someone is at SP3, is it a requirement to slipstream SP3 to a Windows ... If you feel confident enough to mount the drive in another Windows XP computer or in a USB enclosure then you can access the damaged registry and try to fix things. ... If you cannot mount the disk in another XP machine or USB enclosure then this will be a very difficult problem to solve, you will need to use a special boot disk with an onboard registry editor, building such a boot disk is not a trivial matter, it takes several hours and it takes advanced computer skills. ...
    (microsoft.public.windowsxp.general)
  • Re: autoruns mistake
    ... Otherwise it will ask you to install the proper CD. ... If someone is at SP3, is it a requirement to slipstream SP3 to a Windows ... USB enclosure then you can access the damaged registry and try to fix ... need to use a special boot disk with an onboard registry editor, ...
    (microsoft.public.windowsxp.general)
  • Re: OT--SP3?
    ... Going though the registry looking for Print Mirror would be long task. ... before the SP3 installation but that too is a long task. ... the registry entry controlling mirror image printing, ...
    (alt.sys.pc-clone.dell)
  • Re: Do subinacl.exe and reset.cmd work on XP Home Edition SP2?
    ... understand the reason why does SP3 want to delete that key and I don't know ... control to all the registry keys and secedit.exe reset the registry security ... #E064 Analisi della sezione di installazione ... Installazione Service Pack 3 non completata. ...
    (microsoft.public.windowsupdate)
  • Re: SFC Issue after running Win XP Service Pack 3
    ... SourcePath variable exists. ... XP Installation disk). ... same message about inserting the SP3 CD came up!! ... from modifying Registry Key values to ...
    (microsoft.public.windowsxp.general)