Samuraiken
asked on
Getting a large amount of Warnings with the ID 40960.
I am administering an https:// WSS 3.0 site, and just recently I have been getting these warnings. I am not seeing any user problems at this time. The site is running fine from what I can see. But these warnings are coming every 2 hours. I tried looking online and I havent seen errors that resemble ours here. Im hoping that someone can help me out here before the warning turn to errors. The SharePoint server is not getting the error. The errors are appearing on the SQL server. The error message that Im getting is
Type: Warning
Source: LSASRV
Category: SPNEGO (Negotiator)
Event ID: 40960
Description:
The Security System detected an authentication error for the server <domain server>. The failure code from authentication protocol Kerberos was The specified user does not exist (0xc0000064).
I did question the DC admin and asked if there were any changes done to the DC server, and was told nothing new was done. I checked the events on the exchange server and didnt find any warnings that resembled mine. I myself didnt do anything to the SQL server. If there is anymore information that is needed let me know.
Thank you
Type: Warning
Source: LSASRV
Category: SPNEGO (Negotiator)
Event ID: 40960
Description:
The Security System detected an authentication error for the server <domain server>. The failure code from authentication protocol Kerberos was The specified user does not exist (0xc0000064).
I did question the DC admin and asked if there were any changes done to the DC server, and was told nothing new was done. I checked the events on the exchange server and didnt find any warnings that resembled mine. I myself didnt do anything to the SQL server. If there is anymore information that is needed let me know.
Thank you
ASKER
imran Thank you.
That site that suggested was one of the first sites I went to and read many times over but none of the post resembled my errors although I did try the ones that were similar. But I did look it over again after you sent the link. Again thank you but it couldn't help me out.
That site that suggested was one of the first sites I went to and read many times over but none of the post resembled my errors although I did try the ones that were similar. But I did look it over again after you sent the link. Again thank you but it couldn't help me out.
ASKER
ChiefIT Thank you, But that article also didnt really help me out. I am not getting the same errors nor warnings as the ones described on the article. I did read over it but there wasnt a solution there to help me. Again thank you for the assistance.
ASKER
Does anyone else have any ideas? This is extremely frustrating.
Are these clients imaged clients. WSUS has a problem with imaged clients. The SIDs need to be changed. It would make sense that the image would have a different SID as the client. Maybe even after sysprep or newsid is run. Let me see if I can find the article on imaged clients and straightening out the SID in WSUS. You have to straighten out the SID in AD and WSUS.
https://www.experts-exchange.com/questions/23106023/WSUS-3-0-not-detecting-the-VMware-client-machines.html
https://www.experts-exchange.com/questions/23106023/WSUS-3-0-not-detecting-the-VMware-client-machines.html
ASKER
ChiefIT,
Thank you for the help but the machines were not imaged. And we are not running WSUS. This is running on the SQL Server. Again thank you.
Thank you for the help but the machines were not imaged. And we are not running WSUS. This is running on the SQL Server. Again thank you.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Also, for the client to be granted an access ticket from kerberos, you need to have communications on port 88 and the kerberos key distribution center (KDC) needs to be started on your authenticating server. If this is not a DC and just a SQL server, then you might try a telnet connection to your kerberos server on port 88 to make sure you don't have a blockage on port 88 from one computer to another.
http://www.eventid.net/display.asp?eventid=40960&eventno=787&source=LsaSrv&phase=1