Re: Multiple event IDs 675, 676 and 681
- From: Meinolf Weber <meiweb(nospam)@gmx.de>
- Date: Tue, 29 Jul 2008 06:40:57 +0000 (UTC)
Hello Madrilleno,
Basically these are authentication errors, maybe through some service accounts where you changed passwords? So if you check the events, are they pointing to users or computers?
Did you look here:
675
http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1
676
http://www.eventid.net/display.asp?eventid=676&eventno=668&source=Security&phase=1
681
http://www.eventid.net/display.asp?eventid=681&eventno=3&source=Security&phase=1
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
I have a domain running in mixed mode which has two Server 2008 DCs
and a Server 2000 DC. The server 2000 DC holds the five FSMO roles.
I am seeing a lot of Event ID 675,676 & 681 in the security logs
denoting authentication failures.
I have trawled around on the Internet for hours, but have not found
any pointers to why these are happening.
The DC is a virtual server which I am using to stage on my route to
running the domain as Server 2008 native. There are no corresponding
errors on the 2k8 DCs.
.
- Follow-Ups:
- Re: Multiple event IDs 675, 676 and 681
- From: Madrilleno
- Re: Multiple event IDs 675, 676 and 681
- Prev by Date: Re: How to uninstall silver light
- Next by Date: Re: Multiple event IDs 675, 676 and 681
- Previous by thread: Re: How to uninstall silver light
- Next by thread: Re: Multiple event IDs 675, 676 and 681
- Index(es):
Relevant Pages
|