[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 966
  • Last Modified:

error 675

Dear Support

About once every second I get the following error on one of our four domain controllers.
This is a DC at a site office and the others have the same entry but with the details for this DC. I have checked all services, and scheduled tasks on this computer and none of them are using the administrator account.

Event Type:        Failure Audit
Event Source:    Security
Event Category:                Account Logon
Event ID:              675
Date:                     26/10/2011
Time:                     16:49:22
User:                     NT AUTHORITY\SYSTEM
Computer:          **********
Description:
Pre-authentication failed:
               User Name:        Administrator
               User ID:                                DOMAIN\Administrator
               Service Name:   krbtgt/DOMAIN.LOCAL
               Pre-Authentication Type:             0x2
               Failure Code:     0x18
               Client Address: 127.0.0.1

TIA

0
macomsupport
Asked:
macomsupport
  • 6
  • 6
1 Solution
 
Neil RussellTechnical Development LeadCommented:
Run the following script on your DC, It will output all the services and what accounts are being used by them
 
Set objService = GetObject("winmgmts:") 
Set objCol = objService.ExecQuery("SELECT * FROM Win32_Service") 
 For Each obj In objCol
       S = S & obj.DisplayName & " ( " & obj.StartName & " )" & vbCrLf
 Next 
WScript.Echo S

Open in new window

0
 
Neil RussellTechnical Development LeadCommented:
Hmmm quick question... Have recently upgraded ANYTHING in your infrastructure?
0
 
Neil RussellTechnical Development LeadCommented:
And is the time correct on ALL your servers? Another common cause.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
macomsupportAuthor Commented:
Hello

I ran the script and the all say localsystem or networkservice. I did recently have a time sync issue. But I have fixed that by setting a new npt soure, and all servers have the same time as the PDC now.
0
 
Neil RussellTechnical Development LeadCommented:
Have you run a DCDIAG on ALL of your DC's? All ERROR FREE?
0
 
macomsupportAuthor Commented:
Yes I have
0
 
macomsupportAuthor Commented:
Hello

I just noticed that on the PDC the 675 error always has the following two errors preceding it


Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      680
Date:            27/10/2011
Time:            10:26:28
User:            NT AUTHORITY\SYSTEM
Computer:      PDC
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      administrator@DOMAIN
 Source Workstation:      PDC
 Error Code:      0xC0000064


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

and this error:

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      680
Date:            27/10/2011
Time:            10:26:28
User:            NT AUTHORITY\SYSTEM
Computer:      NP-LDNDC01
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      Administrator
 Source Workstation:      PDC
 Error Code:      0xC000006A

Thanks in advanced.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


0
 
macomsupportAuthor Commented:
Hello

I just noticed that on the PDC the 675 error always has the following two errors preceding it


Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      680
Date:            27/10/2011
Time:            10:26:28
User:            NT AUTHORITY\SYSTEM
Computer:      PDC
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      administrator@DOMAIN
 Source Workstation:      PROBLEM_DC
 Error Code:      0xC0000064


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

and this error:

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      680
Date:            27/10/2011
Time:            10:26:28
User:            NT AUTHORITY\SYSTEM
Computer:     PDC
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      Administrator
 Source Workstation:     PROBLEM_DC
 Error Code:      0xC000006A

Thanks in advanced.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
Neil RussellTechnical Development LeadCommented:
It is possible that your accounts are out of sync from when you had your time sync problem.  I would go for demoting your problem DC, taking it off the domain, deleting the computer account, joining the domain and the dcpromo it back to a DC.
0
 
Neil RussellTechnical Development LeadCommented:
It might sound a lot but will be quicker in the long run than spending the next 4 days trying to troubleshoot.
0
 
macomsupportAuthor Commented:
I rebooted the server and this error has stoppped.

thanks you for your help
0
 
macomsupportAuthor Commented:
rebooting the server fixed the issus
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now