• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2221
  • Last Modified:

Security System Error (ID 40960) on File Server

Hi folks!

We run an environment with five Windows Server 2003 R2 x64 servers. We have two domain controllers, and then three servers for various purposes. On the server that acts primarily as our file server, I am seeing recurring errors from the Security System in our event log.

Specifically, the error ID I am normally seeing is 40960 and the specific error text is one of the following two:

"The Security System detected an authentication error for the server LDAP/server.domain/domain@domain.  The failure code from authentication protocol Kerberos was "The user account has time restrictions and may not be logged onto at this time.
 (0xc000006f)".

And:

"The Security System detected an authentication error for the server LDAP/server.domain/domain@domain.  The failure code from authentication protocol Kerberos was "The referenced account is currently disabled and may not be logged on to.
 (0xc0000072)".

In all cases, the server it is referencing in the error is one of our two domain controllers. Each domain controller appears in some of the errors. I cannot figure out why this would be the case, though, as the computer accounts for our domain controllers should certainly not be disabled nor have any time restrictions on when they can interact with another server.

These errors are appearing regularly at least every hour or two.

Any suggestions would be most appreciated.

Thanks,
Ithizar
0
Ithizar
Asked:
Ithizar
  • 6
  • 5
  • 3
1 Solution
 
ToxaconCommented:
Those error messages simply mean that someone who has account login time restrictions is trying to log in. The other account is disabled and someone is trying to log in with that account. Just look at the error messages to see the referenced account.
0
 
IthizarAuthor Commented:
I'm not sure I understand what you mean "look at the error messages." I posted the complete text of the error. All I did was obscure the name of our server and domain. But there are no user accounts mentioned anywhere in the error.
0
 
ToxaconCommented:
There should be Event Type, Event Source, Event Category, Event ID (which is 40960), Date, Time, User and Computer in addition to the Description you posted.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
IthizarAuthor Commented:
The user says "N/A".
0
 
ToxaconCommented:
What are the Event Source and Category? Do you have restricted accounts in your domain?
0
 
IthizarAuthor Commented:
Source: Userenv
Category: None
Type: Error
Event ID: 1053
User: NT AUTHORITY\SYSTEM

That's all relevant information, other than things like the date or the name of the server.

Forgive me if I seem dense, but what do you mean by "restricted accounts"?
0
 
ToxaconCommented:
If a user account is restricted, then, for example the account can only logon to specified workstation or the account can logon at specified time. Just open the user properties, Account tab, click the Logon Hours button to view time restrictions as your case has.

"The user account has time restrictions and may not be logged onto at this time.
 (0xc000006f)".


0
 
IthizarAuthor Commented:
But it says that the user in question is "N/A", which implies to me that it's not a user account that's involved in this case. In fact, the error message seems to say that it's one server attempting to authenticate to another. Is that not correct?

In any event, we don't generally use restrictions like that on our accounts, and the errors are happening at all hours of the day and night, with regularity, so it wouldn't just be at a specific time of the day when certain accounts couldn't log on.
0
 
ToxaconCommented:
That's really odd... As if domain controller account has been warped or something... And still the first error is related to user account...

Have you had problems with DCs not replicating or trouble running DCPROMO or anything?

Does the dcdiag pass ok or does it give errors?
0
 
IthizarAuthor Commented:
I have not had any problems that I am aware of with replication. We have two domain controllers on the network, and I don't see any replication errors in their logs, and all of the account information and so forth seems synchronized between the two of them. We have not run DCPROMO at all since the domain controllers were originally created.

The system I am posting these errors from is not a domain controller, so dcdiag is not applicable. I can run it on our two domain controllers and see if either or both return errors if you think that might reveal something related.
0
 
ChiefITCommented:
What backup software do you use?

0
 
ChiefITCommented:
And please list your servers by Server A, Server B, etc, with the roles of the servers, (meaning DNS, DHCP, AD,)
0
 
IthizarAuthor Commented:
Sorry for the delay in responding.

We use Macrium Reflect for backing up our servers.

Our servers are as follows:

Server A: Domain Controller, DNS, DHCP
Server B: Domain Controller, DNS
Server C: File Server, GhostCast Server, Symantec Endpoint Protection Server
Server D: SQL Database Server, Application Server
Server E: Remote Access/Terminal Server
Server F: Deep Freeze/BrowseControl Security Server
0
 
ChiefITCommented:
Server C: File Server, GhostCast Server, Symantec Endpoint Protection Server

Server C is the one having problems?  If so, this is good news.

Symantec Endpoint Protection has a console management, and many domain features need to be addressed in order to allow these domain features. I do believe one of them is Active Directory.

Your errors are stating that you are having problems communicating with the LDAP, (Lightweight Directory Access Protocol). AS MOST ANTIVIRUS and FIREWALLS, they are geared for home use, that doesn't really need access to an LDAP (or Kerberos Authentictation). Instead credentials are held locally. I know little about Symmantec Endpoint protection. I do think it's a system state firewall. System state means that it will block communications unless that computer initiates the call.

When a client first logs on, it will initiate a authentication with the server. So, logons are not the problem. However, when it comes time to renew the Kerberos ticket, the server initiates the procedure to do so. Symantec may be blocking this, (because it is a system state firewall).

When choosing a FIREWALL or ANTIVIRUS product, always make sure you look at what that product blocs, and what is needed for acceptions or rules to work right.

Your file server is having problems updating its Kerberos ticket. That's what your errors are stating.

Client type firewall (SEP):
http://www.symantec.com/business/support/index?page=content&id=TECH92440&locale=en_US

Now, this could be DNS related problems, but it would appear more like a problem with a system state firewall.  To verify that DNS works, use an SRV ping to ping the Server SeRVice records. These are the records that point the way to your domain controller for authentication.

SRV PING:
http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/AdminTips/DHCPandDNS/AQuickTipToVerifyTheSRVRecordsOfDomainControllers.html
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

  • 6
  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now