Re: Security Log Help
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 04/28/05
- Next message: Steven L Umbach: "Re: Microsoft Baseline Security Analyzer (MBSA) 1.2.1"
- Previous message: Steven L Umbach: "Re: Event ID 577 & 578 are filling Security Event Logs"
- In reply to: Johnse: "Re: Security Log Help"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 27 Apr 2005 19:10:58 -0500
If netdiag and dcdiag results look good then it probably is not related to
dns configuration for the domain controller. The link below is a good read
on dns best practices.
http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382
If you have downlevel clients in the domain such as NT4.0 or Windows 98 you
may see failed account logon events for kerberos but I don't know why you
would have not seen that before if that is the case. I see user juser,
Client address: 10.0.0.127, and SERVER2 failed referenced in the
logon/account logon failures. The error codes indicate bad password. You
might want to check to see what is going on with those objects. One thing to
try is running netdiag on Client address: 10.0.0.127, and SERVER2 to see
what is reported and check with juser to see if there are any logon
problems. I don't know if you are seeing failures for just certain users or
most everyone. --- Steve
"Johnse" <Johnse@discussions.microsoft.com> wrote in message
news:42FD7605-6D26-49ED-8E16-3D848F81AAC8@microsoft.com...
>I ran netdiag & dcdiag & no errors reported. IP addresses for DNS are all
> correct. Should the pdc point only to itself for DNS? Old server is out
> of
> DNS & new servers are listed. I'll set other DNS servers to point to pdc
> first & let you know if it fixes. Any other ideas if this doesn't fix the
> problem?
>
> "Steven L Umbach" wrote:
>
>> Try running the support tools netdiag and then dcdiag on your domain
>> controller to see if it reports any pertinent problems that may help in a
>> solution and verify that your domain controllers have the correct IP
>> addresses for preferred dns servers in their tcp/ip properties and that
>> the
>> "old" domain controller IP address is not listed. Generally the pdc fsmo
>> should point to itself as it's preferred dns server and other domain
>> controllers for the domain should point to the pdc fsmo first and then
>> themselves. The old domain controller's IP should also be removed from
>> DHCP
>> scopes and verified that the correct domain controllers IP addresses are
>> listed.--- Steve
>>
>>
>> "Johnse" <Johnse@discussions.microsoft.com> wrote in message
>> news:135F66D0-80B0-4070-B564-E2F334716710@microsoft.com...
>> > As soon as I retired my previous PDC I started getting errors in my
>> > security
>> > eventy log & I don't know why. Help!
>> > I followed KB255690 for transferring FSMO roles, KB295419 for
>> > transferring
>> > the Global Catalog. My other event logs are clean. It's just the
>> > security
>> > log that gets all the errors.
>> >
>> > Event ID: 537
>> > Source: Security
>> > Type: Failure
>> > User: NT AUTHORITY\SYSTEM
>> > Category: Logon/Logoff
>> > Reason: An unexpected error occurred during logon
>> > Username:
>> > Domain:
>> > Logon Type: 3
>> > Logon Process: Kerbos
>> > Authentication Package: Kerbos
>> > Workstation Name: -
>> >
>> > Event ID: 675
>> > Source: Security
>> > Type: Failure
>> > User: NT AUTHORITY\SYSTEM
>> > Category: Logon/Logoff
>> > Reason: An unexpected error occurred during logon
>> > Username:
>> > Domain:
>> > Logon Type: 3
>> > Logon Process: Kerbos
>> > Authentication Package: Kerbos
>> > Workstation Name: -
>> >
>> > Event ID: 675
>> > Source: Security
>> > Type: Failure
>> > User: NT AUTHORITY\SYSTEM
>> > Category: Account Logon
>> > Description: Pre-authentication failed
>> > Username: juser
>> > User ID: DOMAIN\juser
>> > Service Name: krbtgt/DOMAIN
>> > Pre-Authentication Type: 0x2
>> > Failure Code: 0x18
>> > Client address: 10.0.0.127
>> >
>> >
>> > Event ID: 681
>> > Source: Security
>> > Type: Failure
>> > User: NT AUTHORITY\SYSTEM
>> > Category: Account Logon
>> > Description: The logon to account: supervisor by
>> > MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: SERVER2 failed.
>> > The
>> > error code was: 3221225578
>> >
>> >
>> >
>> >
>>
>>
>>
- Next message: Steven L Umbach: "Re: Microsoft Baseline Security Analyzer (MBSA) 1.2.1"
- Previous message: Steven L Umbach: "Re: Event ID 577 & 578 are filling Security Event Logs"
- In reply to: Johnse: "Re: Security Log Help"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
