Solved

Event ID 4

Posted on 2011-02-23
3
428 Views
Last Modified: 2012-06-21
I am getting the following error on a member server in the domain.  The DCs are not showing any errors.  All servers are 2003. The machine called jmh-e6500 is listed in ADUC.  Will deleteing it from ADUC fix the issue?  The other machine mentioned in the error, server MH$ is an XP workstation, not a server.  Any help is appreciated.
cja

Event Type:      Error
Event Source:      Kerberos
Event Category:      None
Event ID:      4
Date:            2/22/2011
Time:            12:16:56 PM
User:            N/A
Computer:      SERVER-ADMIN-2
Description:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server MH$.  The target name used was cifs/JMH-E6500.Company-Dom.company.com. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (Company-DOM.COMPANY.COM), and the client realm.   Please contact your system administrator.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
Comment
Question by:cja-tech-guy
  • 2
3 Comments
 
LVL 14

Accepted Solution

by:
Wonko_the_Sane earned 500 total points
ID: 34970183
Unless you get those errors all the time and notice any real issues it's not too much of a concern, but here's some things to check:

- make sure the DNS records for the servers and clients mentioned are OK, including Reverse DNS ones
-Check if there is a duplicate Service Principal Name (SPN), or an SPN assigned to the wrong machine. You can use tools such as ADSIEDIT to view them for the machines involved, you are probably looking for a SPN that starts with HOST/
You can also export the entire domain:
ldifde -f dumpfile.txt -d dc=company-Dom,dc=company,dc=com-l serviceprincipalname
0
 

Author Comment

by:cja-tech-guy
ID: 34970684
The only thing I see in DNS is duplicate records for the IP of the machine named MH and JMH-E6500.  JMH-E6500 is no longer a member of the domain, it was removed months ago.  MH is a new machine that was added about 3 weeks ago.  Should I delete the DNS record for JMH-E6500?  What happens if I delete a DNS record for a machine that is still a member of the domain?  Does it get recreated?

Thanks,

cja
0
 
LVL 14

Expert Comment

by:Wonko_the_Sane
ID: 34970789
Usually it will get recreated, at least in most standard configurations. You can trigger the registration from the machine by running "ipconfig /registerdns".

If there are duplicate records you may want to remove the one that's no longer valid.
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I have never ceased to be amazed how many problems you can encounter on a fresh install of a Windows operating system.  This is certainly case in point& Unable to complete ANY MSI installation.  This means Windows Updates are failing and I can't …
by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
A company’s greatest vulnerability is their email. CEO fraud, ransomware and spear phishing attacks are the no1 threat to a company’s security. Cybercrime is responsible for the largest loss of money to companies today with losses projected to r…

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now