Solved

Security System Error (ID 40960) on File Server

Posted on 2011-02-14
14
2,083 Views
Last Modified: 2012-05-11
Hi folks!

We run an environment with five Windows Server 2003 R2 x64 servers. We have two domain controllers, and then three servers for various purposes. On the server that acts primarily as our file server, I am seeing recurring errors from the Security System in our event log.

Specifically, the error ID I am normally seeing is 40960 and the specific error text is one of the following two:

"The Security System detected an authentication error for the server LDAP/server.domain/domain@domain.  The failure code from authentication protocol Kerberos was "The user account has time restrictions and may not be logged onto at this time.
 (0xc000006f)".

And:

"The Security System detected an authentication error for the server LDAP/server.domain/domain@domain.  The failure code from authentication protocol Kerberos was "The referenced account is currently disabled and may not be logged on to.
 (0xc0000072)".

In all cases, the server it is referencing in the error is one of our two domain controllers. Each domain controller appears in some of the errors. I cannot figure out why this would be the case, though, as the computer accounts for our domain controllers should certainly not be disabled nor have any time restrictions on when they can interact with another server.

These errors are appearing regularly at least every hour or two.

Any suggestions would be most appreciated.

Thanks,
Ithizar
0
Comment
Question by:Ithizar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
  • 3
14 Comments
 
LVL 8

Expert Comment

by:Toxacon
ID: 34887282
Those error messages simply mean that someone who has account login time restrictions is trying to log in. The other account is disabled and someone is trying to log in with that account. Just look at the error messages to see the referenced account.
0
 

Author Comment

by:Ithizar
ID: 34887918
I'm not sure I understand what you mean "look at the error messages." I posted the complete text of the error. All I did was obscure the name of our server and domain. But there are no user accounts mentioned anywhere in the error.
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34888394
There should be Event Type, Event Source, Event Category, Event ID (which is 40960), Date, Time, User and Computer in addition to the Description you posted.
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:Ithizar
ID: 34889958
The user says "N/A".
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34890988
What are the Event Source and Category? Do you have restricted accounts in your domain?
0
 

Author Comment

by:Ithizar
ID: 34891048
Source: Userenv
Category: None
Type: Error
Event ID: 1053
User: NT AUTHORITY\SYSTEM

That's all relevant information, other than things like the date or the name of the server.

Forgive me if I seem dense, but what do you mean by "restricted accounts"?
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34891173
If a user account is restricted, then, for example the account can only logon to specified workstation or the account can logon at specified time. Just open the user properties, Account tab, click the Logon Hours button to view time restrictions as your case has.

"The user account has time restrictions and may not be logged onto at this time.
 (0xc000006f)".


0
 

Author Comment

by:Ithizar
ID: 34891284
But it says that the user in question is "N/A", which implies to me that it's not a user account that's involved in this case. In fact, the error message seems to say that it's one server attempting to authenticate to another. Is that not correct?

In any event, we don't generally use restrictions like that on our accounts, and the errors are happening at all hours of the day and night, with regularity, so it wouldn't just be at a specific time of the day when certain accounts couldn't log on.
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34891821
That's really odd... As if domain controller account has been warped or something... And still the first error is related to user account...

Have you had problems with DCs not replicating or trouble running DCPROMO or anything?

Does the dcdiag pass ok or does it give errors?
0
 

Author Comment

by:Ithizar
ID: 34892864
I have not had any problems that I am aware of with replication. We have two domain controllers on the network, and I don't see any replication errors in their logs, and all of the account information and so forth seems synchronized between the two of them. We have not run DCPROMO at all since the domain controllers were originally created.

The system I am posting these errors from is not a domain controller, so dcdiag is not applicable. I can run it on our two domain controllers and see if either or both return errors if you think that might reveal something related.
0
 
LVL 38

Expert Comment

by:ChiefIT
ID: 34893842
What backup software do you use?

0
 
LVL 38

Expert Comment

by:ChiefIT
ID: 34893852
And please list your servers by Server A, Server B, etc, with the roles of the servers, (meaning DNS, DHCP, AD,)
0
 

Author Comment

by:Ithizar
ID: 35060221
Sorry for the delay in responding.

We use Macrium Reflect for backing up our servers.

Our servers are as follows:

Server A: Domain Controller, DNS, DHCP
Server B: Domain Controller, DNS
Server C: File Server, GhostCast Server, Symantec Endpoint Protection Server
Server D: SQL Database Server, Application Server
Server E: Remote Access/Terminal Server
Server F: Deep Freeze/BrowseControl Security Server
0
 
LVL 38

Accepted Solution

by:
ChiefIT earned 500 total points
ID: 35063300
Server C: File Server, GhostCast Server, Symantec Endpoint Protection Server

Server C is the one having problems?  If so, this is good news.

Symantec Endpoint Protection has a console management, and many domain features need to be addressed in order to allow these domain features. I do believe one of them is Active Directory.

Your errors are stating that you are having problems communicating with the LDAP, (Lightweight Directory Access Protocol). AS MOST ANTIVIRUS and FIREWALLS, they are geared for home use, that doesn't really need access to an LDAP (or Kerberos Authentictation). Instead credentials are held locally. I know little about Symmantec Endpoint protection. I do think it's a system state firewall. System state means that it will block communications unless that computer initiates the call.

When a client first logs on, it will initiate a authentication with the server. So, logons are not the problem. However, when it comes time to renew the Kerberos ticket, the server initiates the procedure to do so. Symantec may be blocking this, (because it is a system state firewall).

When choosing a FIREWALL or ANTIVIRUS product, always make sure you look at what that product blocs, and what is needed for acceptions or rules to work right.

Your file server is having problems updating its Kerberos ticket. That's what your errors are stating.

Client type firewall (SEP):
http://www.symantec.com/business/support/index?page=content&id=TECH92440&locale=en_US

Now, this could be DNS related problems, but it would appear more like a problem with a system state firewall.  To verify that DNS works, use an SRV ping to ping the Server SeRVice records. These are the records that point the way to your domain controller for authentication.

SRV PING:
http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/AdminTips/DHCPandDNS/AQuickTipToVerifyTheSRVRecordsOfDomainControllers.html
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
what is the difference between basic disks and dinamyic disks? 6 95
inplace upgrade from Windows 2003 R2 to 2012 8 150
Enterprise Mode 4 71
Time server on domain 3 62
This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question