Failure Audit in Security Event log for SBS Server 2003.

Does anyone have any idea what this EVent Log relates too in my Security Log on the server? I only get this for this one machine, like 500 entries a day! and I have noticed in the list of client computers on the server that this computer is listed, but its Operating System isnt, kinda making me wonder if it is even seeing it on the domain? But the user has no problems logging on. Strange things happen sometimes on her system as well such as as her default printer being changed etc.

Pre-authentication failed:
       User Name:      BUSINESS2$
       User ID:            kengrodyford\BUSINESS2$
       Service Name:      krbtgt/KENGRODYFORD.LOCAL
       Pre-Authentication Type:      0x2
       Failure Code:      0x18
       Client Address:

Thanks in advance.

Who is Participating?
mickinoz2005Connect With a Mentor Commented:
Just having a quick look at it, these are kerberos codes for problems with the user account

18 shows up as 18 0x12 Clients credentials have been revoked Account disabled, expired, or locked out.

So it would indicate that there is a problem in that machine, If you get the user to logon to another machine does that machine display the same errors. Also check the time on that machine that it is the same as the server.

The fact that it is happening many times would indicate definitely a problem btw client and server. You could make a copy of her profile then remove pc from domain rename it and rejoin. Then log on as user logoff and back on as admin copy her old profile over her new one now minus user.dat and any other user.* from the root of the profile and then get her to log back in. (This just means all her icons and shortcuts and all them users things are still there for her.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.