Failure Audit in Security Event log for SBS Server 2003.

Posted on 2006-05-03
Last Modified: 2012-05-05
Does anyone have any idea what this EVent Log relates too in my Security Log on the server? I only get this for this one machine, like 500 entries a day! and I have noticed in the list of client computers on the server that this computer is listed, but its Operating System isnt, kinda making me wonder if it is even seeing it on the domain? But the user has no problems logging on. Strange things happen sometimes on her system as well such as as her default printer being changed etc.

Pre-authentication failed:
       User Name:      BUSINESS2$
       User ID:            kengrodyford\BUSINESS2$
       Service Name:      krbtgt/KENGRODYFORD.LOCAL
       Pre-Authentication Type:      0x2
       Failure Code:      0x18
       Client Address:

Thanks in advance.

Question by:gqchris
    LVL 5

    Accepted Solution

    Just having a quick look at it, these are kerberos codes for problems with the user account

    18 shows up as 18 0x12 Clients credentials have been revoked Account disabled, expired, or locked out.

    So it would indicate that there is a problem in that machine, If you get the user to logon to another machine does that machine display the same errors. Also check the time on that machine that it is the same as the server.

    The fact that it is happening many times would indicate definitely a problem btw client and server. You could make a copy of her profile then remove pc from domain rename it and rejoin. Then log on as user logoff and back on as admin copy her old profile over her new one now minus user.dat and any other user.* from the root of the profile and then get her to log back in. (This just means all her icons and shortcuts and all them users things are still there for her.

    LVL 5

    Expert Comment


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Is Threat Intelligence?

    Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

    I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
    ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now