[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1570
  • Last Modified:

Event ID - 40960/40961

Hi,

We are seeing an intermittent issue with random desktops in our domain.

Event ID 40960 is being recorded with the following content:

The description for Event ID ( 40960 ) in Source ( LSASRV ) cannot be found. Either the component that raises this event is not installed on your local computer, or the installation is corrupted. You can install or repair the component on the local computer, or contact the component manufacturer for a newer version.

If the event was saved from another computer or forwarded from a remote computer, you might have to include display information with the events when saving them or when setting up the forwarding s exchangeRFR/SERVERNAME REMOVED, Kerberos, "There are currently no logon servers available to service the logon request.
 
Error 40961 also:

The description for Event ID ( 40961 ) in Source ( LSASRV ) cannot be found. Either the component that raises this event is not installed on your local computer, or the installation is corrupted. You can install or repair the component on the local computer, or contact the component manufacturer for a newer version.

If the event was saved from another computer or forwarded from a remote computer, you might have to include display information with the events when saving them or when setting up the forwarding s exchangeRFR/SERVERNAME REMOVED, "The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.
 (0xc0000388)".

The behaviour from the desktop is that the user is prompted for Exchange authentication, then randomly the problem goes away! Any ideas?

D
0
ncomper
Asked:
ncomper
1 Solution
 
RadweldCommented:
This would suggest your Active Directory servers are not able to keep up with Exchange, the actual 40960 usually relates to a kerberos downgrade which isnt usually a problem. For you though, you need to look at your DC's you may need to provision another Global Catalogue DC, either way you need to have a look as which DC Exchange is communicating with.

Get-ExchangeServer | FL Orizinatingserver will report which DC your connected to.

You will want to perform addition tests on this DC to ensure it's healthy..
0
 
ncomperAuthor Commented:
We seem to experience this problem accessing ALL resources in the domain, not just Exchange..

UNC shares are also impacted and authentication to our proxy server.

?
0
 
Don ThomsonCommented:
You may want to check your DNS settings on the workstations

ipconfig /all

The Domain server that has the DNS server should be first. On some domains, the DHCP server is sometimes the router or the DCHP on the router has been turned on in addition to the main DC DHCP.

If the DC DNS Server IP is not the primary, you can set it as the primary under the DNS tab of the network card V4 TCPIP configuration

Normally I set it in the following order
IP for DNS Server
IP for Router
External IP of DNS server (i.e.  4.2.2.2)

0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
RadweldCommented:
"We seem to experience this problem accessing ALL resources in the domain, not just Exchange..
UNC shares are also impacted and authentication to our proxy server"

more evidence to support AD related issues.

Start by running DCDIAG on your DC's and if you have Windows 2003 DC's you can also run NETDIAG on those machines.
0
 
ncomperAuthor Commented:
The problem turned out to be related to network issues we have been experiencing.

Our access switches were running highly utilized, we have now fixed this issue and users are no longer experiencing this issue.

Thanks.
0
 
ncomperAuthor Commented:
No fix provided.

Fix for this issue was to fix an internal network issue.
0
 
LeonGarfieldCommented:
For me it turned out to be a faulty network cable run.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now