Security Log Help

From: Johnse (Johnse_at_discussions.microsoft.com)
Date: 04/21/05 

Date: Wed, 20 Apr 2005 15:26:03 -0700

As soon as I retired my previous PDC I started getting errors in my security
eventy log & I don't know why. Help!
I followed KB255690 for transferring FSMO roles, KB295419 for transferring
the Global Catalog. My other event logs are clean. It's just the security
log that gets all the errors.

Event ID: 537
Source: Security
Type: Failure
User: NT AUTHORITY\SYSTEM
Category: Logon/Logoff
Reason: An unexpected error occurred during logon
Username:
Domain:
Logon Type: 3
Logon Process: Kerbos
Authentication Package: Kerbos
Workstation Name: -

Event ID: 675
Source: Security
Type: Failure
User: NT AUTHORITY\SYSTEM
Category: Logon/Logoff
Reason: An unexpected error occurred during logon
Username:
Domain:
Logon Type: 3
Logon Process: Kerbos
Authentication Package: Kerbos
Workstation Name: -

Event ID: 675
Source: Security
Type: Failure
User: NT AUTHORITY\SYSTEM
Category: Account Logon
Description: Pre-authentication failed
Username: juser
User ID: DOMAIN\juser
Service Name: krbtgt/DOMAIN
Pre-Authentication Type: 0x2
Failure Code: 0x18
Client address: 10.0.0.127

Event ID: 681
Source: Security
Type: Failure
User: NT AUTHORITY\SYSTEM
Category: Account Logon
Description: The logon to account: supervisor by
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: SERVER2 failed. The
error code was: 3221225578

 
 

Relevant Pages

  • Event Log Errors
    ... As soon as I retired my previous PDC I started getting errors in my security ... Type: Failure ... An unexpected error occurred during logon ... Authentication Package: Kerbos ...
    (microsoft.public.win2000.general)
  • Re: bad password for MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    ... Failure Events Are Logged When the Welcome Screen Is Enabled ... Event Source: Security ... The machine is using a machine local account. ... Logon failure auditing is enabled. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Security Log
    ... reduces the number of failed logons events. ... > I have set up auditing for failed logon attempts for the ... > Event Type: Failure Audit ... > Event Source: Security ...
    (microsoft.public.win2000.security)
  • Re: Logon Error - Event ID 533
    ... The suggestion regarding security logs should not apply if the overwrite option has been selected and you have the default maximum of 512 kb. ... How to Set Log Size and Overwrite Options ... The user cannot logon and no Profile folder is made, ... screen whether with a domain account or a local account from the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Help with Security Logs
    ... Security" means that the event was generated by the security ... Primary User is the user context that actually performed the access; ... Client User is the user on behalf of whom the file was accessed. ... The Logon ID fields for Primary User and Client User identify a unique logon ...
    (microsoft.public.security)