?
Solved

Security System Error (ID 40960) on File Server

Posted on 2011-02-14
14
Medium Priority
?
2,140 Views
Last Modified: 2012-05-11
Hi folks!

We run an environment with five Windows Server 2003 R2 x64 servers. We have two domain controllers, and then three servers for various purposes. On the server that acts primarily as our file server, I am seeing recurring errors from the Security System in our event log.

Specifically, the error ID I am normally seeing is 40960 and the specific error text is one of the following two:

"The Security System detected an authentication error for the server LDAP/server.domain/domain@domain.  The failure code from authentication protocol Kerberos was "The user account has time restrictions and may not be logged onto at this time.
 (0xc000006f)".

And:

"The Security System detected an authentication error for the server LDAP/server.domain/domain@domain.  The failure code from authentication protocol Kerberos was "The referenced account is currently disabled and may not be logged on to.
 (0xc0000072)".

In all cases, the server it is referencing in the error is one of our two domain controllers. Each domain controller appears in some of the errors. I cannot figure out why this would be the case, though, as the computer accounts for our domain controllers should certainly not be disabled nor have any time restrictions on when they can interact with another server.

These errors are appearing regularly at least every hour or two.

Any suggestions would be most appreciated.

Thanks,
Ithizar
0
Comment
Question by:Ithizar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
  • 3
14 Comments
 
LVL 8

Expert Comment

by:Toxacon
ID: 34887282
Those error messages simply mean that someone who has account login time restrictions is trying to log in. The other account is disabled and someone is trying to log in with that account. Just look at the error messages to see the referenced account.
0
 

Author Comment

by:Ithizar
ID: 34887918
I'm not sure I understand what you mean "look at the error messages." I posted the complete text of the error. All I did was obscure the name of our server and domain. But there are no user accounts mentioned anywhere in the error.
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34888394
There should be Event Type, Event Source, Event Category, Event ID (which is 40960), Date, Time, User and Computer in addition to the Description you posted.
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:Ithizar
ID: 34889958
The user says "N/A".
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34890988
What are the Event Source and Category? Do you have restricted accounts in your domain?
0
 

Author Comment

by:Ithizar
ID: 34891048
Source: Userenv
Category: None
Type: Error
Event ID: 1053
User: NT AUTHORITY\SYSTEM

That's all relevant information, other than things like the date or the name of the server.

Forgive me if I seem dense, but what do you mean by "restricted accounts"?
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34891173
If a user account is restricted, then, for example the account can only logon to specified workstation or the account can logon at specified time. Just open the user properties, Account tab, click the Logon Hours button to view time restrictions as your case has.

"The user account has time restrictions and may not be logged onto at this time.
 (0xc000006f)".


0
 

Author Comment

by:Ithizar
ID: 34891284
But it says that the user in question is "N/A", which implies to me that it's not a user account that's involved in this case. In fact, the error message seems to say that it's one server attempting to authenticate to another. Is that not correct?

In any event, we don't generally use restrictions like that on our accounts, and the errors are happening at all hours of the day and night, with regularity, so it wouldn't just be at a specific time of the day when certain accounts couldn't log on.
0
 
LVL 8

Expert Comment

by:Toxacon
ID: 34891821
That's really odd... As if domain controller account has been warped or something... And still the first error is related to user account...

Have you had problems with DCs not replicating or trouble running DCPROMO or anything?

Does the dcdiag pass ok or does it give errors?
0
 

Author Comment

by:Ithizar
ID: 34892864
I have not had any problems that I am aware of with replication. We have two domain controllers on the network, and I don't see any replication errors in their logs, and all of the account information and so forth seems synchronized between the two of them. We have not run DCPROMO at all since the domain controllers were originally created.

The system I am posting these errors from is not a domain controller, so dcdiag is not applicable. I can run it on our two domain controllers and see if either or both return errors if you think that might reveal something related.
0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 34893842
What backup software do you use?

0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 34893852
And please list your servers by Server A, Server B, etc, with the roles of the servers, (meaning DNS, DHCP, AD,)
0
 

Author Comment

by:Ithizar
ID: 35060221
Sorry for the delay in responding.

We use Macrium Reflect for backing up our servers.

Our servers are as follows:

Server A: Domain Controller, DNS, DHCP
Server B: Domain Controller, DNS
Server C: File Server, GhostCast Server, Symantec Endpoint Protection Server
Server D: SQL Database Server, Application Server
Server E: Remote Access/Terminal Server
Server F: Deep Freeze/BrowseControl Security Server
0
 
LVL 39

Accepted Solution

by:
ChiefIT earned 2000 total points
ID: 35063300
Server C: File Server, GhostCast Server, Symantec Endpoint Protection Server

Server C is the one having problems?  If so, this is good news.

Symantec Endpoint Protection has a console management, and many domain features need to be addressed in order to allow these domain features. I do believe one of them is Active Directory.

Your errors are stating that you are having problems communicating with the LDAP, (Lightweight Directory Access Protocol). AS MOST ANTIVIRUS and FIREWALLS, they are geared for home use, that doesn't really need access to an LDAP (or Kerberos Authentictation). Instead credentials are held locally. I know little about Symmantec Endpoint protection. I do think it's a system state firewall. System state means that it will block communications unless that computer initiates the call.

When a client first logs on, it will initiate a authentication with the server. So, logons are not the problem. However, when it comes time to renew the Kerberos ticket, the server initiates the procedure to do so. Symantec may be blocking this, (because it is a system state firewall).

When choosing a FIREWALL or ANTIVIRUS product, always make sure you look at what that product blocs, and what is needed for acceptions or rules to work right.

Your file server is having problems updating its Kerberos ticket. That's what your errors are stating.

Client type firewall (SEP):
http://www.symantec.com/business/support/index?page=content&id=TECH92440&locale=en_US

Now, this could be DNS related problems, but it would appear more like a problem with a system state firewall.  To verify that DNS works, use an SRV ping to ping the Server SeRVice records. These are the records that point the way to your domain controller for authentication.

SRV PING:
http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/AdminTips/DHCPandDNS/AQuickTipToVerifyTheSRVRecordsOfDomainControllers.html
0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question