Failure Audit - 673

[Edu-IT]

Has anyone come across this before? It's clogging up the event viewer!

 

Service Ticket Request:

User Name: [email protected]

User Domain: DOMAIN.INTERNAL

Service Name: AFL nNm6nMPj

Service ID: -

Ticket Options: 0x40800000

Ticket Encryption Type: -

Client Address: 10.56.117.123

Failure Code: 0x1B

Logon GUID: -

Transited Services: -

 

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event ID: 673

Category: Account Logon

User: NT AUTHORITY\SYSTEM

[DrPerceptron]

Have you been to the client and looked it up?

 

Usually it implies some sort of Kerberos error/SPN error... there's quite a few bits and pieces on the net, most suggest enabling Kerberos over TCP and checking your SPN's (spent ages doing it with OCS and have since exiled it from my head).

[Sylv3r]

Heres a MS hotfix

 

Event ID 677 and event ID 673 audit failure messages are repeatedly logged to the Security log of domain controllers that are running Windows 2000 and Windows Server 2003

 

Also does that workstation have the same time as the server or at least within 5 mins?

[Edu-IT]

Yes the clocks are correct.

 

@DrPerceptron Not sure I follow.

 

Edit: Seems each Failure is followed by a Success.

Edited October 31, 2009 by Edu-IT