Event id's in security log on server

  • Thread starter Thread starter Joe
  • Start date Start date
J

Joe

Hi

I have two DC and in the security event log i'm geting the
following Events and it is logging up my log.

The event id are:

677: Service Ticket Request Failed
676: Authentication Ticket Request Failed
675: Pre-authentication failed

These are hapening all the time. All the clients have the
latest service pack installed. I tried what technet told
me to do, but i still get the warnings.

Help will be appreciated
 
The following link may be of help describing those events. Also run netdiag and
dcdiag on the domain controllers and netdiag on one of the workstations looking
for failed tests. The events 675 and 676 are users trying to log on with bad
usernames or passwords. You may want to check the computer names in those failed
logons to see if it provides a clue. --- Steve

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/w
indows2000serv/maintain/monitor/logevnts.asp
http://tinyurl.com/o4fa -- Same as above, shorter link.
 
Check to make sure you are not blocking Policy Inheritance
in the Domain Controllers OU in Active Directory. If it is
being blocked, clear the check mark. As soon as the group
policy is refreshed on the domain controllers you will
notice the problem stop.

To manually force a group policy refresh gto the domain
controller, command line and run the following tool:

secedit /refreshpolicy machine_policy /enforce

Check the application log for SceCli entry. Once you see
it appear the policy has been updated. YOu should also
notice a few new successful security audits that tell you
that the policy has been modified.

If you are logging successful logon attempts you may want
to turn this off. If you don't your logs may fill up very
rapidly. If you already have this option off you may want
to turn it on for a little while just to make sure that
the problem has been fixed.
 
Back
Top