Windows 2003 Server - Event ID: 673 help

From: TM (Thomas_McFarlane_at_Yahoo.Com)
Date: 07/08/03 

Date: Tue, 8 Jul 2003 10:26:00 -0400

I have a Windows 2003 Standard Server setup as a Root Forest with internal
DNS service installed. Alose AD and IIS are installed on the same server.
All Event Logs are reporting successfull/Informational audits with the
exception of the Security event log, every 30 successfull audit events,
there is a "Failed audit" event is generated. The following event is
captured from the security audit log:

<<<
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 673
Date: 7/8/2003
Time: 9:45:32 AM
User: NT AUTHORITY\SYSTEM
Computer: W2003SERVER01

Description:

Service Ticket Request:
  User Name:
  User Domain: W2003DOMAIN.NET
  Service Name: host/W2003Server01.W2003Domain.net
  Service ID: -
  Ticket Options: 0x40830000
  Ticket Encryption Type: -
  Client Address: 127.0.0.1
  Failure Code: 0xD
  Logon GUID: -
  Transited Services: -

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

>>>

End of event log

TIA

Thomas

Relevant Pages

  • Re: SBS "Newbie" question - viewing logins
    ... THANKS for the help - are these audits set in the security event log? ... first "success audit". ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Event Log (audit object access) logging too much?
    ... >I did not get the results I anticipated in the event log. ... >the workstation the actual file being accessed remotely. ... >memory - and that delete is also logged in the Security log. ... can I audit only changes & deletes to files like I ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Service Restart - (Client - Server Architecture)
    ... and then click Local Security Policy. ... click Security Settings, click Local Policies, and then click Audit ... Double-click Audit Logon Event and then click Success and Failure. ... Event Log entries are added under the Security log. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Joining two tables based on timeframes
    ... I'm not sure what your intended output is*, but you can apply your logic as ... Audit Status has five columns (shows that change in status on a ticket ... This issue I am having is that the log file doesnt show the status' of the ...
    (microsoft.public.access.queries)
  • Re: Access is denied when calling a remote serviced component (framework 1.1->1.0 issue)
    ... Audit Account logon event ... Start/Control panel/Administrative Tools/Local Security Policy/ ... After that we should find some events in the Security Log in the event log. ...
    (microsoft.public.dotnet.framework.aspnet)
Quantcast