Internet access dies after pile-up of EVENT ID 676 (reposted to this forum) any assistance helpful...
From: mealsormissles (nospam_at_thisaddress.corn)
Date: 07/08/03
- Next message: Roy Deslaureirs: "Re: forcing 1 user logon."
- Previous message: clio: "I forgot my password"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 8 Jul 2003 16:04:32 -0400
Hello all:
Last week, internet connectivity stopped - no email, no www. It stopped
sometime after 6:00am (that's when I received my last automated health
report to my outside address).
The users restarted the server. Access is fine. In the security event log
however, there is a string of:
>>>
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 676
Date: 6/25/2003
Time: 4:01:36 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Authentication Ticket Request Failed:
User Name: auserinthedomain
Supplied Realm Name: OURDOMAIN.LOCAL
Service Name: krbtgt/OURDOMAIN.LOCAL
Ticket Options: 0x40810010
Failure Code: 0x17
Client Address: 127.0.0.1
>>>
There are several hundreds of these messages with the user ALWAYS indicating
the same 'real' user on the domain. The only variable is the client address
which balances out 50/50 between 127.0.0.1 and the IP address of the
external ethernet adapter of my SBS2000 server.
The messages appear in spurts of several messages during any given minute
and then spaced 7-15 minutes apart.
No other messages of note in the security log.
However, there have been multiple all-port scan attacks (perhaps twice as
many usual) reported this week.
One (out 10) user did report that it took her significantly longer than
usual to login this morning.
Since the restart (20 minutes uptime) the internet has worked fine, no user
complaints and only one error message in the security log - a failure Audit,
event 537. ( It's the typical blank Kerberos message only indicated, Logon
Type:3)
Any ideas or suggestions as to what may be happening?
System is an SBS2000 server with ISA. The configuration is dual NIC with the
external attached to a DSL router.
Thanks in advance.
j*
p.s.
I went into User Manager and disabled "auserinthedomain", just in case....
I reposted this message here after two postings to the SBS forum with no
replies.
- Next message: Roy Deslaureirs: "Re: forcing 1 user logon."
- Previous message: clio: "I forgot my password"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
