• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2150
  • Last Modified:

LSASRV 40968 2008 r2, exchange 2010 sp1

2008 r2, exchange 2010 sp1, not a domain controller.

Over the last 2 days I started to receive the below alert.  I ran microsoft malicious removal tool and it came up clean.  Does anyone have any idea how to figure this out?


Log Name:      System
Source:        LsaSrv
Date:          3/8/2011 11:03:14 AM
Event ID:      40968
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      MYCIOMPUTER
Description:
The Security System has received an authentication request that could not be decoded. The request has failed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="LsaSrv" Guid="{199FE037-2B82-40A9-82AC-E1D46C792B99}" />
    <EventID>40968</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-03-08T19:03:14.470834200Z" />
    <EventRecordID>11640</EventRecordID>
    <Correlation />
    <Execution ProcessID="472" ThreadID="576" />
    <Channel>System</Channel>
    <Computer>MyComputer</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>
0
BBQSTEAK
Asked:
BBQSTEAK
1 Solution
 
praveenkumare_spCommented:
Some one has tried to authenticate themselves to this Server , the server has not accepted the person

this explains the above event
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now