Event ID - 40960/40961

Hi,

We are seeing an intermittent issue with random desktops in our domain.

Event ID 40960 is being recorded with the following content:

The description for Event ID ( 40960 ) in Source ( LSASRV ) cannot be found. Either the component that raises this event is not installed on your local computer, or the installation is corrupted. You can install or repair the component on the local computer, or contact the component manufacturer for a newer version.

If the event was saved from another computer or forwarded from a remote computer, you might have to include display information with the events when saving them or when setting up the forwarding s exchangeRFR/SERVERNAME REMOVED, Kerberos, "There are currently no logon servers available to service the logon request.
 
Error 40961 also:

The description for Event ID ( 40961 ) in Source ( LSASRV ) cannot be found. Either the component that raises this event is not installed on your local computer, or the installation is corrupted. You can install or repair the component on the local computer, or contact the component manufacturer for a newer version.

If the event was saved from another computer or forwarded from a remote computer, you might have to include display information with the events when saving them or when setting up the forwarding s exchangeRFR/SERVERNAME REMOVED, "The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.
 (0xc0000388)".

The behaviour from the desktop is that the user is prompted for Exchange authentication, then randomly the problem goes away! Any ideas?

D
LVL 5
ncomperAsked:
Who is Participating?
 
ncomperAuthor Commented:
The problem turned out to be related to network issues we have been experiencing.

Our access switches were running highly utilized, we have now fixed this issue and users are no longer experiencing this issue.

Thanks.
0
 
RadweldCommented:
This would suggest your Active Directory servers are not able to keep up with Exchange, the actual 40960 usually relates to a kerberos downgrade which isnt usually a problem. For you though, you need to look at your DC's you may need to provision another Global Catalogue DC, either way you need to have a look as which DC Exchange is communicating with.

Get-ExchangeServer | FL Orizinatingserver will report which DC your connected to.

You will want to perform addition tests on this DC to ensure it's healthy..
0
 
ncomperAuthor Commented:
We seem to experience this problem accessing ALL resources in the domain, not just Exchange..

UNC shares are also impacted and authentication to our proxy server.

?
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
Don ThomsonCommented:
You may want to check your DNS settings on the workstations

ipconfig /all

The Domain server that has the DNS server should be first. On some domains, the DHCP server is sometimes the router or the DCHP on the router has been turned on in addition to the main DC DHCP.

If the DC DNS Server IP is not the primary, you can set it as the primary under the DNS tab of the network card V4 TCPIP configuration

Normally I set it in the following order
IP for DNS Server
IP for Router
External IP of DNS server (i.e.  4.2.2.2)

0
 
RadweldCommented:
"We seem to experience this problem accessing ALL resources in the domain, not just Exchange..
UNC shares are also impacted and authentication to our proxy server"

more evidence to support AD related issues.

Start by running DCDIAG on your DC's and if you have Windows 2003 DC's you can also run NETDIAG on those machines.
0
 
ncomperAuthor Commented:
No fix provided.

Fix for this issue was to fix an internal network issue.
0
 
LeonGarfieldCommented:
For me it turned out to be a faulty network cable run.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.