Discussion Locked

Kerberos Errors.

0 helpful
5 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi. I turned on logon auditing recently on our domain and I have been getting dozens of these errors every day since then. Basically every computer in our building shows up in the log with one of these errors, however Microsoft has been no help explaining what is wrong exactly. Beats me. Everyone is able to login and use the network. By the errors, I am assuming that we are not able to authenticate using Kerberos. But the errors dont tell me much.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date: 9/17/2003
Time: 9:53:33 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Service Ticket Request Failed:
User Name:
User Domain:
Service Name: krbtgt/(Company Domain)
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 192.168.1.78

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 9/17/2003
Time: 7:25:25 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Pre-authentication failed:
User Name: (User Name)
User ID: (Domain\User Name)
Service Name: krbtgt/(Domain Name)
Pre-Authentication Type: 0x2
Failure Code: 0x25
Client Address: 192.168.1.76

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 9/17/2003
Time: 5:41:34 AM
User: NT AUTHORITY\SYSTEM
Computer: (Domain Controller)
Description:
Logon Failure:
Reason: An unexpected error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -

5 replies

by sgt_shultz

check out www.eventid.net where i searched for event 677 source: security and got this:
See the Documents section, article Event ID 677 for a discussion about this event.

As per Microsoft: "Windows 2000 attempts Kerberos (pass-through) authentication to the trusted Microsoft Windows NT 4.0 domains when Windows 2000 users need access to Windows NT 4.0 resources. The initial attempt and its associated service ticket request do not work because Windows NT 4.0 does not support Kerberos. When this failure occurs, it is logged as an Event ID 677 in the Security log as a failure event, and the NTLM authentication package is then used for authentication." This situation is described in Q302879 and apparently was fixed with SP3.

This event may also indicate that someone may try to login with a forged SID. The failure code for this would be: "0xC000019B". See Q289243.

H. Sean Shilling, Sr.
I have run into this message and hundreds of event ids 677's, when I created a new OU for the Controllers and did not put a link to the Default Domain Controller Policy The minute that I either created an identical Default Domain Policy on the new OU or linked the default one the problems went away.

by sgt_shultz

Doug Hopper
This error usually appears when a user is trying to access a windows 2000 machine which either does not support kerberos authentication, or is running an application that doesn't support Kerberos authentication. Examples would Be Exchange 5.5, MS SQL 7.0, or even Win2k clusters. The reason is that these non-kerberos aware applications do not register a Service Principal Name with the KDC on Win2k domain controllers. It can also happen if users are trying to access servers in a different domain that is not using a kerberos trust. You can see which SPN's are registered on a particular server by performing an LDAP query on the server and grabbing the servicePrincipalName propery. As far as I know these errors can be ignored aslong as you have not turned off NTLM authentication, as it is the fallback method once the kerberos authentication has failed. This is only applicable to Win2k native mode domains, as hybrid mode uses NTLM by default.

Arkady Karasin
I received this error when trying access server moved from my domain to workgroup. After I deleted the disabled computer account from Active Directory, the errors stopped occuring.
Links Q174074 , Q281431 , Q302879 , Event ID 677, A Kerberos Primer, Kerberos in Win2K, Q289243 , Kerberos ticket options, Online Analysis of Security Event Log, Kerberos and authentication troubleshooting
--
sorry, didn't have time to check out all your events but looked like interesting reading...

by rob1150

I dont think that is it, we have a very small domain with no OU's. And no one here is clever enough to forge a SID. Much less the whole office.

by rob1150

Point value changed by question poster.
I seriously need something definitive here.

This discussion is closed to new replies.