Kerberos Errors in the Audit Log.

From: Rob W (nospam_at_myinbox.com)
Date: 09/19/03 

Date: Fri, 19 Sep 2003 17:03:54 -0400

Hi.

I turned on logon auditing recently on our domain and I have been getting dozens of these errors every day since then. Basically every computer in our building shows up in the log with one of these errors, however Microsoft has been no help explaining what is wrong exactly. Beats me. Everyone is able to login and use the network. By the errors, I am assuming that we are not able to authenticate using Kerberos. But the errors don't tell me much.

Any Ideas?

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date: 9/17/2003
Time: 9:53:33 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Service Ticket Request Failed:
User Name:
User Domain:
Service Name: krbtgt/(Company Domain)
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 192.168.1.78

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 9/17/2003
Time: 7:25:25 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Pre-authentication failed:
User Name: (User Name)
User ID: (Domain\User Name)
Service Name: krbtgt/(Domain Name)
Pre-Authentication Type: 0x2
Failure Code: 0x25
Client Address: 192.168.1.76

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 9/17/2003
Time: 5:41:34 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Logon Failure:
Reason: An unexpected error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: - 

-- 
Rob Wilson, N+

Relevant Pages

  • Re: Help, Ive been hacked
    ... ID: 540 Source: Security ... > Event Type: Failure Audit ... > Event Category: Account Logon ... Your computer was not able to renew its address from the network ...
    (microsoft.public.windowsxp.security_admin)
  • Re: bad password for MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    ... Failure Events Are Logged When the Welcome Screen Is Enabled ... Event Source: Security ... The machine is using a machine local account. ... Logon failure auditing is enabled. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Locked myself out of the system
    ... is a member of the domain and reconfigure the security policy from there ... assuming you have network access to the domain controller. ... > logon of the user". ... the computer is a domain controller. ...
    (microsoft.public.win2000.security)
  • Re: Security Log
    ... reduces the number of failed logons events. ... > I have set up auditing for failed logon attempts for the ... > Event Type: Failure Audit ... > Event Source: Security ...
    (microsoft.public.win2000.security)
  • Event Log Errors
    ... As soon as I retired my previous PDC I started getting errors in my security ... Type: Failure ... An unexpected error occurred during logon ... Authentication Package: Kerbos ...
    (microsoft.public.win2000.general)