Failure Audit - 673

Has anyone come across this before? It's clogging up the event viewer!

Quote:

---

Service Ticket Request:
User Name: ADM-04$@DOMAIN.INTERNAL
User Domain: DOMAIN.INTERNAL
Service Name: AFL nNm6nMPj
Service ID: -
Ticket Options: 0x40800000
Ticket Encryption Type: -
Client Address: 10.56.117.123
Failure Code: 0x1B
Logon GUID: -
Transited Services: -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---

Event ID: 673
Category: Account Logon
User: NT AUTHORITY\SYSTEM

Have you been to the client and looked it up?

Usually it implies some sort of Kerberos error/SPN error... there's quite a few bits and pieces on the net, most suggest enabling Kerberos over TCP and checking your SPN's (spent ages doing it with OCS and have since exiled it from my head).

Heres a MS hotfix

Event ID 677 and event ID 673 audit failure messages are repeatedly logged to the Security log of domain controllers that are running Windows 2000 and Windows Server 2003

Also does that workstation have the same time as the server or at least within 5 mins?

Yes the clocks are correct.

@DrPerceptron Not sure I follow.

Edit: Seems each Failure is followed by a Success.