Repeated 675,681 and 677 error codes in security log

From: Craig Barraclough (CraigBarraclough_at_discussions.microsoft.com)
Date: 08/01/05


Date: Mon, 1 Aug 2005 06:59:03 -0700

I hope some can help as i have search all over for an answer to this.

We have a customer with a 2000 domain in mixed mode with a mixture of
win98,2000 and xp machines.

I have been monitoring the event logs on their servers, the security logs
are full of Failure audits with event codes 675 and677. I gather these are
Kerberos related but i can't work out what the failure codes are for and what
could be causing them.
The usernames and client addresses are all different, i haven't been able to
pin it down to any specific machines.

A couple of examples are below

Source: Security
Catergory: Account logon
Type: Failure
Event ID: 675
User: NT AUTHORITY\SYSTEM
Computer: AAA-Primary
Pre-authentication failed
username: ACraig
userID: BRITISH\ACraig
Service Name: krbtgt/BRITISH
Pre-authentication type: 0x2
Failure code: 0x18
Client address: 192.168.3.65

Source: Security
Catergory: Account logon
Type: Failure
Event ID: 675
User: NT AUTHORITY\SYSTEM
Computer: AAA-Primary
Pre-authentication failed
username: Administrator
userID: BRITISH\Administrator
Service Name: krbtgt/BRITISH
Pre-authentication type: 0x2
Failure code: 0x18
Client address: 127.0.0.1

Source: Security
Catergory: Account logon
Type: Failure
Event ID: 677
User: NT AUTHORITY\SYSTEM
Computer: AAA-Primary
Serivce Ticket request Failed
username: ENG02$
User Domain: BRITISH
Service Name: krbtgt/BRITISH
Pre-authentication type: 0x2
Failure code: 0x20
Client address: 192.168.1.27

These events seem to occur at all times of day and night, the client address
are either servers, workstations or even the loopback address.

Anyone any idea what could be causing this?

Cheers

Craig



Relevant Pages

  • Re: Kerberos errors
    ... These machines logon, but still bring back these ticket and pre-authentication errors. ... Client Address: x.x.x.x ... Pre-Authentication Type: 0x0 ... Failure Code: 0x19 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Repeated 675,681 and 677 error codes in security log
    ... > I have been monitoring the event logs on their servers, the security logs ... > The usernames and client addresses are all different, ... > username: ACraig ... > Failure code: 0x18 ...
    (microsoft.public.win2000.security)
  • Re: Security Event ID: 675
    ... Service Name: krbtgt/PLASMAN ... Pre-Authentication Type: 0x2 ... Server is failing when trying to authenticate with itself - since ... (type and failure code). ...
    (microsoft.public.windows.server.sbs)
  • Event ID 675 - Pre-authentication failed
    ... Pre-Authentication Type: 0x2 ... Failure Code: 0x18 ... Client Address: 10.4.68.8 ... Anyone know the solution to this security event log error. ...
    (microsoft.public.win2000.security)
  • Re: Event ID 676
    ... Mark-Allen Perry ... I think where I am confused is the client address.. ... am expecting it to be 'from where' the logon was attempted... ... Failure code 0x12 can be a variety of ...
    (microsoft.public.win2000.security)