Guest QSBSupport Posted February 15, 2008 Posted February 15, 2008 Hello, I have a number of entries in the event log such as this: Feb 15 14:39:07 Domaincontroller.domain MSWinEventLog 3 Security 1470 Fri Feb 15 14:39:01 2008 675 Security SYSTEM User Failure Audit domaincontroller Account Logon Pre-authentication failed: User Name: userbackup$ User ID: %{S-1-5-21-3356799699-3984192466-312495613-3408} Service Name krbtgt/domain Pre-Authentication Type: 0x0 Failure Code: 0x19 Client Address: xxx.xxx.xxx.xxx 1429 They seem to be coming from machine accounts. I have searched but had no success finding out what is causing this. Any suggestions? Thanks.
Guest Meinolf Weber Posted February 15, 2008 Posted February 15, 2008 Re: Errors in the Security Log Hello QSBSupport, Think you are having event id 675: http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1 It will be easier to open the event and push the button in the right down corner, the event will be copied to clipboard and you can just paste it here. easier for reading from everybody here. :-) Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > Hello, > > I have a number of entries in the event log such as this: > > Feb 15 14:39:07 Domaincontroller.domain MSWinEventLog 3 Security 1470 > Fri Feb 15 14:39:01 2008 675 Security SYSTEM User Failure Audit > domaincontroller Account Logon Pre-authentication failed: User Name: > userbackup$ User ID: %{S-1-5-21-3356799699-3984192466-312495613-3408} > Service Name krbtgt/domain Pre-Authentication Type: 0x0 Failure Code: > 0x19 Client Address: xxx.xxx.xxx.xxx 1429 > > They seem to be coming from machine accounts. I have searched but had > no success finding out what is causing this. > > Any suggestions? > > Thanks. >
Guest QSBSupport Posted February 27, 2008 Posted February 27, 2008 Re: Errors in the Security Log I'll do that next time! Thanks "Meinolf Weber" wrote: > Hello QSBSupport, > > Think you are having event id 675: > http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1 > > It will be easier to open the event and push the button in the right down > corner, the event will be copied to clipboard and you can just paste it here. > easier for reading from everybody here. :-) > > Best regards > > Meinolf Weber > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > no rights. > ** Please do NOT email, only reply to Newsgroups > ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > > > Hello, > > > > I have a number of entries in the event log such as this: > > > > Feb 15 14:39:07 Domaincontroller.domain MSWinEventLog 3 Security 1470 > > Fri Feb 15 14:39:01 2008 675 Security SYSTEM User Failure Audit > > domaincontroller Account Logon Pre-authentication failed: User Name: > > userbackup$ User ID: %{S-1-5-21-3356799699-3984192466-312495613-3408} > > Service Name krbtgt/domain Pre-Authentication Type: 0x0 Failure Code: > > 0x19 Client Address: xxx.xxx.xxx.xxx 1429 > > > > They seem to be coming from machine accounts. I have searched but had > > no success finding out what is causing this. > > > > Any suggestions? > > > > Thanks. > > > > >
Recommended Posts