Re: Windows 2003 Pre-authentication failed

When you have the error try the following and post anything you don't
understand:

Run diagnostics against your Active Directory domain.

If you don't have the tools installed, install them from your server install
disk.
d:\support\tools\setup.exe

Run dcdiag, netdiag and repadmin in verbose mode.
-> DCDIAG /V /C /D /E /s:yourdcname > c:\dcdiag.log
-> netdiag.exe /v > c:\netdiag.log (On each dc)
-> repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt

**Note: Using the /E switch in dcdiag will run diagnostics against ALL dc's
in the forest. If you have significant numbers of DC's this test could
generate significant detail and take a long time. You also want to take
into account slow links to dc's will also add to the testing time.

If you download a gui script I wrote it should be simple to set and run
(DCDiag and NetDiag). It also has the option to run individual tests
without having to learn all the switch options. The details will be output
in notepad text files that pop up automagically.

The script is located in the download section on my website at
http://www.pbbergs.com

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.


--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"Andrew Teece" <enate@xxxxxxxxxxxxx> wrote in message
news:uTQ79QrhHHA.5008@xxxxxxxxxxxxxxxxxxxxxxx
Hi
I have a domain controller that has ALOT (read 4 times / minute) of
"Failure Audit" entries in the Security log.

The entries are of ID 675, Category Account Logon. The message is

"Pre-authentication failed:"
Failure Code: 0x19


If I demote the server to just be a member server it is fine. But if i
repromote the server the errors return.



Regards




Andrew Teece
Technical Architect


.

Relevant Pages

  • Cant find DC after running DCPROMO
    ... I have a windows 2000 server with two NIC's. ... Netdiag and dcdiag disagree. ... List of NetBt transports currently configured: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Login issues for Active Directory Users. Unsure of root cause
    ... Run dcdiag, netdiag and repadmin in verbose mode. ... the PCs or Server. ... Directory/Shared folders for the roaming profiles permissions nixed? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Windows cannot obtain the domain controller name for your computer
    ... If you don't have the support tools installed, install them from your server ... Run dcdiag, netdiag and repadmin in verbose mode. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Old DC with problem
    ... If you don't have the tools installed, install them from your server ... Run dcdiag and netdiag in verbose mode. ... If I change connection in AD User & Computers to new Domain Controller, ...
    (microsoft.public.win2000.active_directory)
  • Re: Same logonserver even though a few DCs
    ... Thanks Paul. ... If you don't have the tools installed, install them from your server install ... Run dcdiag, netdiag and repadmin in verbose mode. ...
    (microsoft.public.windows.server.active_directory)