I recently turned on logon auditing recently on our domain controller and I have been getting dozens of these errors every day since then. Basically every computer in our building shows up in the log with one of these errors and also the default share for each user as well example ROB$, however Microsoft has been no help explaining what is wrong exactly. Beats me. Everyone is able to login and use the network. By the errors, I am assuming that we are not able to authenticate using Kerberos but are able to authenticate using NTLM all of the computers are Win2k or WinXP. We we on a peer to peer previously. I have no idea why these errors are coming up. Perhaps I need to change domain to Native Mode? No Idea. But I do need to get these to stop showing. I made the mistake of letting my boss see the log and he knows nothing about networking or Server OS’s but he is pressing me for an explanation. Examples of the errors are below.
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date: 9/17/2003
Time: 9:53:33 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Service Ticket Request Failed:
User Name:
User Domain:
Service Name: krbtgt/(Company Domain)
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 192.168.1.78
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 9/17/2003
Time: 7:25:25 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Pre-authentication failed:
User Name: (User Name)
User ID: (Domain\User Name)
Service Name: krbtgt/(Domain Name)
Pre-Authentication Type: 0x2
Failure Code: 0x25
Client Address: 192.168.1.76