security log

security log

Post by Thoma » Tue, 25 Feb 2003 21:58:46



Will someone tell me what causes these events in the security log and if it
is something that can be fixed.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date:  24-Feb-03
Time:  05:44:40
User:  NT AUTHORITY\SYSTEM
Computer: SERVER01
Description:
Service Ticket Request Failed:
  User Name:
  User Domain:
  Service Name: krbtgt/MSALA.NET
  Ticket Options: 0x2
  Failure Code: 0x20
  Client Address: 127.0.0.1

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 677
Date:  24-Feb-03
Time:  04:52:41
User:  NT AUTHORITY\SYSTEM
Computer: SERVER01
Description:
Service Ticket Request Failed:
  User Name: AMDDT1$
  User Domain: MSALA.NET
  Service Name: krbtgt/MSALA.NET
  Ticket Options: 0x2
  Failure Code: 0x20
  Client Address: 192.168.100.22

Thanks

Thomas Pilkington

 
 
 

security log

Post by Jeff Q » Wed, 26 Feb 2003 23:54:30


Hi Thomas,

Based on my research, this 677 event ID may appear if you get the
TrendMicro Interscan Virus services started.

Trend Micro ServerProtect Agent (antivirus application) running on the
Windows
2000 systems were apparently trying to connect to all systems in the NT 4.0
domain. Since Windows 2000 will attempt a Kerberos connection first, and
since
Windows NT 4.0 does not support Kerberos, the initial attempt to connect
(and
its associated ticket request) failed.

Regards,

Jeff Qiu

Online Support Professional
Microsoft Corporation

This posting is provided ?AS IS? with no warranties, and confers no
rights.

--------------------


>Subject: security log
>Date: Mon, 24 Feb 2003 06:58:46 -0600
>microsoft.public.win2000.advanced_server

>Will someone tell me what causes these events in the security log and if it
>is something that can be fixed.

>Event Type: Failure Audit
>Event Source: Security
>Event Category: Account Logon
>Event ID: 677
>Date:  24-Feb-03
>Time:  05:44:40
>User:  NT AUTHORITY\SYSTEM
>Computer: SERVER01
>Description:
>Service Ticket Request Failed:
>  User Name:
>  User Domain:
>  Service Name: krbtgt/MSALA.NET
>  Ticket Options: 0x2
>  Failure Code: 0x20
>  Client Address: 127.0.0.1

>Event Type: Failure Audit
>Event Source: Security
>Event Category: Account Logon
>Event ID: 677
>Date:  24-Feb-03
>Time:  04:52:41
>User:  NT AUTHORITY\SYSTEM
>Computer: SERVER01
>Description:
>Service Ticket Request Failed:
>  User Name: AMDDT1$
>  User Domain: MSALA.NET
>  Service Name: krbtgt/MSALA.NET
>  Ticket Options: 0x2
>  Failure Code: 0x20
>  Client Address: 192.168.100.22

>Thanks

>Thomas Pilkington



 
 
 

security log

Post by Thoma » Sat, 01 Mar 2003 20:53:08


Thanks for the info, but I don't have TrendMicro Interscan Virus or any
Windows NT boxes on my network.

Again Thanks,

Thomas Pilkington


> Hi Thomas,

> Based on my research, this 677 event ID may appear if you get the
> TrendMicro Interscan Virus services started.

> Trend Micro ServerProtect Agent (antivirus application) running on the
> Windows
> 2000 systems were apparently trying to connect to all systems in the NT
4.0
> domain. Since Windows 2000 will attempt a Kerberos connection first, and
> since
> Windows NT 4.0 does not support Kerberos, the initial attempt to connect
> (and
> its associated ticket request) failed.

> Regards,

> Jeff Qiu

> Online Support Professional
> Microsoft Corporation

> This posting is provided ?AS IS? with no warranties, and confers no
> rights.

> --------------------

> >Subject: security log
> >Date: Mon, 24 Feb 2003 06:58:46 -0600
> >microsoft.public.win2000.advanced_server

> >Will someone tell me what causes these events in the security log and if
it
> >is something that can be fixed.

> >Event Type: Failure Audit
> >Event Source: Security
> >Event Category: Account Logon
> >Event ID: 677
> >Date:  24-Feb-03
> >Time:  05:44:40
> >User:  NT AUTHORITY\SYSTEM
> >Computer: SERVER01
> >Description:
> >Service Ticket Request Failed:
> >  User Name:
> >  User Domain:
> >  Service Name: krbtgt/MSALA.NET
> >  Ticket Options: 0x2
> >  Failure Code: 0x20
> >  Client Address: 127.0.0.1

> >Event Type: Failure Audit
> >Event Source: Security
> >Event Category: Account Logon
> >Event ID: 677
> >Date:  24-Feb-03
> >Time:  04:52:41
> >User:  NT AUTHORITY\SYSTEM
> >Computer: SERVER01
> >Description:
> >Service Ticket Request Failed:
> >  User Name: AMDDT1$
> >  User Domain: MSALA.NET
> >  Service Name: krbtgt/MSALA.NET
> >  Ticket Options: 0x2
> >  Failure Code: 0x20
> >  Client Address: 192.168.100.22

> >Thanks

> >Thomas Pilkington


 
 
 

security log

Post by Jeff Q » Tue, 04 Mar 2003 19:36:36


Hi Thomas,

Do you have other anti-virus software installed?

Please temporarily uninstall/disable them to have a test.

Best Regards,

Jeff Qiu

Online Support Professional
Microsoft Corporation

This posting is provided ?AS IS? with no warranties, and confers no
rights.

--------------------

>Subject: Re: security log
>Date: Fri, 28 Feb 2003 05:53:08 -0600
>microsoft.public.win2000.advanced_server

>Thanks for the info, but I don't have TrendMicro Interscan Virus or any
>Windows NT boxes on my network.

>Again Thanks,

>Thomas Pilkington



>> Hi Thomas,

>> Based on my research, this 677 event ID may appear if you get the
>> TrendMicro Interscan Virus services started.

>> Trend Micro ServerProtect Agent (antivirus application) running on the
>> Windows
>> 2000 systems were apparently trying to connect to all systems in the NT
>4.0
>> domain. Since Windows 2000 will attempt a Kerberos connection first, and
>> since
>> Windows NT 4.0 does not support Kerberos, the initial attempt to connect
>> (and
>> its associated ticket request) failed.

>> Regards,

>> Jeff Qiu

>> Online Support Professional
>> Microsoft Corporation

>> This posting is provided ?AS IS? with no warranties, and confers no
>> rights.

>> --------------------

>> >Subject: security log
>> >Date: Mon, 24 Feb 2003 06:58:46 -0600
>> >microsoft.public.win2000.advanced_server

>> >Will someone tell me what causes these events in the security log and if
>it
>> >is something that can be fixed.

>> >Event Type: Failure Audit
>> >Event Source: Security
>> >Event Category: Account Logon
>> >Event ID: 677
>> >Date:  24-Feb-03
>> >Time:  05:44:40
>> >User:  NT AUTHORITY\SYSTEM
>> >Computer: SERVER01
>> >Description:
>> >Service Ticket Request Failed:
>> >  User Name:
>> >  User Domain:
>> >  Service Name: krbtgt/MSALA.NET
>> >  Ticket Options: 0x2
>> >  Failure Code: 0x20
>> >  Client Address: 127.0.0.1

>> >Event Type: Failure Audit
>> >Event Source: Security
>> >Event Category: Account Logon
>> >Event ID: 677
>> >Date:  24-Feb-03
>> >Time:  04:52:41
>> >User:  NT AUTHORITY\SYSTEM
>> >Computer: SERVER01
>> >Description:
>> >Service Ticket Request Failed:
>> >  User Name: AMDDT1$
>> >  User Domain: MSALA.NET
>> >  Service Name: krbtgt/MSALA.NET
>> >  Ticket Options: 0x2
>> >  Failure Code: 0x20
>> >  Client Address: 192.168.100.22

>> >Thanks

>> >Thomas Pilkington