Networks

Ask something
Question Locked

Event ID Error 4 Kerberos

0 helpful
4 replies

by j.hostler 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hey All,

Getting a Error 4 on a Windows Server 2003 SP2 x64.

The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dingo.coyotesolutions.local. The target name used was ldap/a344f116-c79e-41bf-90ce-a323b5138466._msdcs.coyotesolutions.local. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (COYOTESOLUTIONS.LOCAL), and the client realm. Please contact your system administrator.

This error seems to happening four times an hour even when no one is in the office. There are no duplicate accounts that I have found like the KB article suggests is the problem.

Other thoughts: DC, DNS, IIS, Exchange, Symantec Client Protection

Here is the dcdiag.exe results:
Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\EXCHANGE
Starting test: Connectivity
......................... EXCHANGE passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\EXCHANGE
Starting test: Replications
[Replications Check,EXCHANGE] Inbound replication is disabled.
To correct, run "repadmin /options EXCHANGE -DISABLE_INBOUND_REPL"
[Replications Check,EXCHANGE] Outbound replication is disabled.
To correct, run "repadmin /options EXCHANGE -DISABLE_OUTBOUND_REPL"
......................... EXCHANGE failed test Replications
Starting test: NCSecDesc
......................... EXCHANGE passed test NCSecDesc
Starting test: NetLogons
......................... EXCHANGE passed test NetLogons
Starting test: Advertising
......................... EXCHANGE passed test Advertising
Starting test: KnowsOfRoleHolders
[DINGO] DsBindWithSpnEx() failed with error -2146893022,
The target principal name is incorrect..
Warning: DINGO is the Schema Owner, but is not responding to DS RPC Bind.
[DINGO] LDAP bind failed with error 8341,
A directory service error has occurred..
Warning: DINGO is the Schema Owner, but is not responding to LDAP Bind.
Warning: DINGO is the Domain Owner, but is not responding to DS RPC Bind.
Warning: DINGO is the Domain Owner, but is not responding to LDAP Bind.
Warning: DINGO is the PDC Owner, but is not responding to DS RPC Bind.
Warning: DINGO is the PDC Owner, but is not responding to LDAP Bind.
Warning: DINGO is the Rid Owner, but is not responding to DS RPC Bind.
Warning: DINGO is the Rid Owner, but is not responding to LDAP Bind.
Warning: DINGO is the Infrastructure Update Owner, but is not responding to DS RPC Bind.
Warning: DINGO is the Infrastructure Update Owner, but is not responding to LDAP Bind.
......................... EXCHANGE failed test KnowsOfRoleHolders
Starting test: RidManager
......................... EXCHANGE failed test RidManager
Starting test: MachineAccount
......................... EXCHANGE passed test MachineAccount
Starting test: Services
......................... EXCHANGE passed test Services
Starting test: ObjectsReplicated
......................... EXCHANGE passed test ObjectsReplicated
Starting test: frssysvol
......................... EXCHANGE passed test frssysvol
Starting test: frsevent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may
cause Group Policy problems.
......................... EXCHANGE failed test frsevent
Starting test: kccevent
......................... EXCHANGE passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 13:49:04
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 13:57:33
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 14:13:41
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 14:17:28
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 14:17:53
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 14:35:08
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 11/20/2008 14:35:08
Event String: The kerberos client received a
......................... EXCHANGE failed test systemlog
Starting test: VerifyReferences
......................... EXCHANGE passed test VerifyReferences

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : coyotesolutions
Starting test: CrossRefValidation
......................... coyotesolutions passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... coyotesolutions passed test CheckSDRefDom

Running enterprise tests on : coyotesolutions.local
Starting test: Intersite
......................... coyotesolutions.local passed test Intersite
Starting test: FsmoCheck
......................... coyotesolutions.local passed test FsmoCheck

Thanks in advance all,
Joe

4 replies

by 45geek

From your post it looks like one of two things has happened. 64-bit kerberos sometimes flips between 32 and 64 bit because of a known problem with the W0W engine (Search MS. KB's kerberos failure in 64-bit) But because you can still authenticate the test for the intersite I suspect that you have an infection.
Personally I would try a restore from a clean backup to a seperate box and run the test again to note the differences any differences with the external(auth user) would confirm an infection. Then you just have to figure out where the infection is coming from. Also I've seen intermittent problems with 64 bit with leaking memory, remember that all it has to do is drop just one bit to cause an invalid kerberos calculation and then an error. SYSVol error (test failed or repeated errors) also tends to point to a failing hard drive. Have you done a HDD stress test with something like "Check-it" or the manufactures available HDD utility software???

Good Luck Joe!!!

by j.hostler

Hey All,
Finally got this issue solved. It ended up being that AD became corrupt on one of our servers. So did a force removal of ad. and everything seems to be working good thus far. havent decided if i want to place AD on this machine again.

Thanks,
Joe

by nickkhan

HI
I have this problem with windows XP Pro, and it is happening with one laptop do you mean that delete the AD profile disjoin the domain and re-join it.

This discussion is closed to new replies.