Re: Event ID: 673 - Failure Audit
From: Ben (bjblackmore_at_xyz.hotmail.com)
Date: Tue, 24 May 2005 10:16:44 +0100
Thanks for the heads up. I've just tried his solution. Won't know for a
while, the error seems to pop up at random times, 4am last night!
"MikeH" <MikeH@discussions.microsoft.com> wrote in message
> Ben, there is another post on 4.8.2005 from SteveErvo with a similar
> He resolved it by assigning a service principle name (SPN) for the machine
> he was getting this error on.
> I am seeing this error, but it follows a Kerberos Pre-authentication Error
> 0x19 - indicating the information provided for the authentication was
> incomplete. Immediately following it I get the error you're talking about.
> I am still working on my issue, but thought I'd give you this head's up...
> "Ben" wrote:
>> I'm receiving the following error in my security log on our server. I've
>> check the Microsoft Kbase, and eventid.net but I can't find anything to
>> describe what the problem is. I have found details on event id 673, but
>> describe events with Ticket Option 0x40830000 nothing describing Option
>> 0x40810000. This is the only error being received, and it seems to be
>> happening at random times (I have one at 21:15 and 01:34). Can anyone
>> some light on this?
>> Event Type: Failure Audit
>> Event Source: Security
>> Event Category: Account Logon
>> Event ID: 673
>> Date: 22/05/2005
>> Time: 15:34:03
>> User: NT AUTHORITY\SYSTEM
>> Computer: SERVER1
>> Service Ticket Request:
>> User Name: SERVER2$@DOMAIN.COM
>> User Domain: DOMAIN.COM
>> Service Name: host/server2.domain.com
>> Service ID: -
>> Ticket Options: 0x40810000
>> Ticket Encryption Type: -
>> Client Address: 192.168.254.130
>> Failure Code: 0x12
>> Logon GUID: -
>> Transited Services: -
>> For more information, see Help and Support Center at