windows 2003 event id 672 failure audit
Windows Server Forum Index Windows Server
Server discussion on Windows platform.
 
 FAQFAQ   MemberlistMemberlist     RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 
 
Google
 
Web winserverhelp.com
windows 2003 event id 672 failure audit

 
Post new topic   Reply to topic    Windows Server Forum Index -> Security
Author Message
bruce
Guest
Posted: Mon Jan 03, 2005 10:31 pm    Post subject: windows 2003 event id 672 failure audit Reply with quote
Since our upgrade to Windows2003 on our DCs, we've started logging lots
of failure audit 672s. All of the MS documentation I've found indicates
this event is only logged upon successful authentication. We're logging
failures. Any ideas? I'm tempted to ignore them like 675s.


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 672
Date: 1/3/2005
Time: 9:20:45 AM
User: NT AUTHORITY\SYSTEM
Computer: DC1
Description:
Authentication Ticket Request:
User Name: joeuser
Supplied Realm Name: MYDOMAIN
User ID: -
Service Name: krbtgt/MYDOMAIN
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x17
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: 10.1.30.83
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Back to top
Steven L Umbach
Guest
Posted: Tue Jan 04, 2005 1:18 am    Post subject: Re: windows 2003 event id 672 failure audit Reply with quote
Was that user using a Windows 9X or NT4.0 computer possibly?? If so
down-level computers can not use kerberos and this may be normal. If these
are for XP Pro/W2K/W2003 computers check that there dns configuration is
correct in that they use domain controllers running dns as their only
preferred dns servers and try running the netdiag support tool on that
computer to see if there is any problem with dns/dc discovery/kerberos/trust
or secure channel. Review the link below to make sure your Active Directory
dns is configured correctly. --- Steve

http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382

"bruce" <badiii@DELyahoo.com> wrote in message
news:Xns95D375349C2FAbadiiiyahoocom@207.46.248.16...
Quote:
Since our upgrade to Windows2003 on our DCs, we've started logging lots
of failure audit 672s. All of the MS documentation I've found indicates
this event is only logged upon successful authentication. We're logging
failures. Any ideas? I'm tempted to ignore them like 675s.


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 672
Date: 1/3/2005
Time: 9:20:45 AM
User: NT AUTHORITY\SYSTEM
Computer: DC1
Description:
Authentication Ticket Request:
User Name: joeuser
Supplied Realm Name: MYDOMAIN
User ID: -
Service Name: krbtgt/MYDOMAIN
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x17
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: 10.1.30.83
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Back to top
 
Post new topic   Reply to topic    Windows Server Forum Index -> Security All times are GMT
Page 1 of 1

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




New Topics Powered by phpBB