KDC Event ID 7 and Wins startup errors.

Hi

OS: SBS 2003R2 SP2

Change Control Information: Administrator Password Changed on 17/11/09

Issue Details:

A schaduled reboot was done on the server on 18/11/09. After having a look
at the Event Logs once the system is back up I discovered KDC errors
(indicated below) just before the reboot and after the reboot was initiated.
Further WINS did not startup after the reboot (errors indicated below). But
manually going to services and starting the WINS worked without issues. I am
concerned whether I need to take any actions for these errors or they are
possible one off errors caused by the time of authentication and the reboot.
In the past I have never received these errors during a reboot. Currently the
server is working and authenticating users with out issues.

Appreciate your thoughts.

Regards
Gihan


Event Log Sequence (From System and Security Logs):

__________________________________________________ __________________________________________________ ___________
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 18/11/2009
Time: 17:31:33
User: <DOMAINNAME>\<ADMINUSER>
Computer: <SBSSERVER>
Description:
The process explorer.exe has initiated the restart of computer <SBSSERVER>
on behalf of user <DOMAINNAME>\<ADMINUSER> for the following reason: Other
(Planned)
Reason Code: 0x85000000
Shutdown Type: restart
Comment: Maintenance Reboot. No WindowsUpdates installed.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 85 ...Â…
__________________________________________________ __________________________________________________ ___________
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 18/11/2009
Time: 17:33:33
User: N/A
Computer: <SBSSERVER>
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was <USER_A>@<DOMAINNAME> and
lookup type 0x20.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 17 00 00 c0 ...À
__________________________________________________ __________________________________________________ ___________
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 18/11/2009
Time: 17:33:33
User: N/A
Computer: <SBSSERVER>
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was <USER_A> and lookup type 0x0.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
<HEX Information Deleted>
__________________________________________________ __________________________________________________ ___________

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 18/11/2009
Time: 17:33:33
User: NT AUTHORITY\SYSTEM
Computer: <SBSSERVER>
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: <USER_A>
Domain: <DOMAINNAME>
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <SBSSERVER>
Caller User Name: <SBSSERVER>$
Caller Domain: <DOMAINNAME>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 8808
Transited Services: -
Source Network Address: 192.168.0.1
Source Port: 62892


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
__________________________________________________ __________________________________________________ ___________
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 18/11/2009
Time: 17:33:34
User: NT AUTHORITY\SYSTEM
Computer: <SBSSERVER>
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: <USER_A>
Domain: <DOMAINNAME>
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <SBSSERVER>
Caller User Name: <SBSSERVER>$
Caller Domain: <DOMAINNAME>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 8808
Transited Services: -
Source Network Address: 192.168.0.1
Source Port: 62895


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

__________________________________________________ __________________________________________________ ___________
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 18/11/2009
Time: 17:33:34
User: NT AUTHORITY\SYSTEM
Computer: <SBSSERVER>
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: <USER_A>
Domain: <DOMAINNAME>
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <SBSSERVER>
Caller User Name: <SBSSERVER>$
Caller Domain: <DOMAINNAME>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 8808
Transited Services: -
Source Network Address: 192.168.0.1
Source Port: 62895


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

__________________________________________________ __________________________________________________ ___________
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 18/11/2009
Time: 17:33:35
User: NT AUTHORITY\SYSTEM
Computer: <SBSSERVER>
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: <USER_A>
Domain: <DOMAINNAME>
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <SBSSERVER>
Caller User Name: <SBSSERVER>$
Caller Domain: <DOMAINNAME>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 8808
Transited Services: -
Source Network Address: 192.168.0.1
Source Port: 62896


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

__________________________________________________ __________________________________________________ ___________

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 18/11/2009
Time: 17:33:36
User: NT AUTHORITY\SYSTEM
Computer: <SBSSERVER>
Description:
Logon Failure:
Reason: An error occurred during logon
User Name: <SBSSERVER>$
Domain: <DOMAINNAME>.LOCAL
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC00000DC
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

__________________________________________________ __________________________________________________ ___________
Event Type: Information
Event Source: Wins
Event Category: None
Event ID: 4098
Date: 18/11/2009
Time: 17:33:45
User: N/A
Computer: <SBSSERVER>
Description:
WINS was terminated by the service controller. WINS will gracefully terminate.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b1 08 00 00 00 00 00 00 ±.......

__________________________________________________ __________________________________________________ ___________
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6006
Date: 18/11/2009
Time: 17:33:45
User: N/A
Computer: <SBSSERVER>
Description:
The Event log service was stopped.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:

__________________________________________________ __________________________________________________ ___________
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6005
Date: 18/11/2009
Time: 17:39:32
User: N/A
Computer: <SBSSERVER>
Description:
The Event log service was started.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
<HEX Information Deleted>

__________________________________________________ __________________________________________________ ___________

Event Type: Error
Event Source: Wins
Event Category: None
Event ID: 4224
Date: 18/11/2009
Time: 17:40:51
User: N/A
Computer: <SBSSERVER>
Description:
WINS encountered a database error. This may or may not be a serious error.
WINS will try to recover from it. You can check the database error events
under 'Application Log' category of the Event Viewer for the Exchange
Component, ESENT, source to find out more details about database errors. If
you continue to see a large number of these errors consistently over time (a
span of few hours), you may want to restore the WINS database from a backup.
The error number is in the second DWORD of the data section.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: a2 04 00 00 01 fc ff ff ¢....üÿÿ

__________________________________________________ __________________________________________________ ___________
Event Type: Error
Event Source: Wins
Event Category: None
Event ID: 4318
Date: 18/11/2009
Time: 17:40:51
User: N/A
Computer: <SBSSERVER>
Description:
WINS could not start due to a missing or corrupt database. Restore the
database using WINS Manager (or winscl.exe found in the Windows 2000 Resource
Kit) and restart WINS. If WINS still does not start, begin with a fresh copy
of the database. To do this: 1) Delete all the files in the
%%SystemRoot%%\system32\WINS directory. NOTE: If the WINS database
file (typically named wins.mdb) is not in the above directory, check
the registry for the full filepath. Delete the .mdb file. NOTE:
If jet*.log are not in the above directory, check the registry for the
directory path. Delete all log files 2) Restart WINS.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 8f 07 00 00 01 00 00 e0 Â�......Ã*

__________________________________________________ __________________________________________________ ___________
Event Type: Information
Event Source: Wins
Event Category: None
Event ID: 4097
Date: 18/11/2009
Time: 17:46:53
User: N/A
Computer: <SBSSERVER>
Description:
WINS initialized properly and is now fully operational.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 04 00 00 00 00 00 00 m.......

__________________________________________________ __________________________________________________ ___________

IMO, in the absence of ongoing symptoms, you can probably ignore these log
entries. It's pretty common to get errors during a restart as various
functions stop and start at different speeds.

However, I would try to restart the server just to see if WINS fails to
start again. I don't like to ignore startup failures like that, even those
that are easy to fix by just manually starting the service. I'm concerned
about running into a failure during an unexpected or unattended startup,
such as a power failure, so if the service often fails to start without
manual intervention, I'd probably want to fix that.

What was the occasion for the scheduled reboot?

"GihanZ" <> wrote in message
news:BF02E874-6E69-4E15-94F3-...
> Hi
>
> OS: SBS 2003R2 SP2
>
> Change Control Information: Administrator Password Changed on 17/11/09
>
> Issue Details:
>
> A schaduled reboot was done on the server on 18/11/09. After having a look
> at the Event Logs once the system is back up I discovered KDC errors
> (indicated below) just before the reboot and after the reboot was
> initiated.
> Further WINS did not startup after the reboot (errors indicated below).
> But
> manually going to services and starting the WINS worked without issues. I
> am
> concerned whether I need to take any actions for these errors or they are
> possible one off errors caused by the time of authentication and the
> reboot.
> In the past I have never received these errors during a reboot. Currently
> the
> server is working and authenticating users with out issues.
>
> Appreciate your thoughts.
>
> Regards
> Gihan
>
>
> Event Log Sequence (From System and Security Logs):
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Information
> Event Source: USER32
> Event Category: None
> Event ID: 1074
> Date: 18/11/2009
> Time: 17:31:33
> User: <DOMAINNAME>\<ADMINUSER>
> Computer: <SBSSERVER>
> Description:
> The process explorer.exe has initiated the restart of computer <SBSSERVER>
> on behalf of user <DOMAINNAME>\<ADMINUSER> for the following reason: Other
> (Planned)
> Reason Code: 0x85000000
> Shutdown Type: restart
> Comment: Maintenance Reboot. No WindowsUpdates installed.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 85 ...Â…
> __________________________________________________ __________________________________________________ ___________
> Event Type: Error
> Event Source: KDC
> Event Category: None
> Event ID: 7
> Date: 18/11/2009
> Time: 17:33:33
> User: N/A
> Computer: <SBSSERVER>
> Description:
> The Security Account Manager failed a KDC request in an unexpected way.
> The
> error is in the data field. The account name was <USER_A>@<DOMAINNAME> and
> lookup type 0x20.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 17 00 00 c0 ...À
> __________________________________________________ __________________________________________________ ___________
> Event Type: Error
> Event Source: KDC
> Event Category: None
> Event ID: 7
> Date: 18/11/2009
> Time: 17:33:33
> User: N/A
> Computer: <SBSSERVER>
> Description:
> The Security Account Manager failed a KDC request in an unexpected way.
> The
> error is in the data field. The account name was <USER_A> and lookup type
> 0x0.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> <HEX Information Deleted>
> __________________________________________________ __________________________________________________ ___________
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 18/11/2009
> Time: 17:33:33
> User: NT AUTHORITY\SYSTEM
> Computer: <SBSSERVER>
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: <USER_A>
> Domain: <DOMAINNAME>
> Logon Type: 8
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: <SBSSERVER>
> Caller User Name: <SBSSERVER>$
> Caller Domain: <DOMAINNAME>
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 8808
> Transited Services: -
> Source Network Address: 192.168.0.1
> Source Port: 62892
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> __________________________________________________ __________________________________________________ ___________
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 18/11/2009
> Time: 17:33:34
> User: NT AUTHORITY\SYSTEM
> Computer: <SBSSERVER>
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: <USER_A>
> Domain: <DOMAINNAME>
> Logon Type: 8
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: <SBSSERVER>
> Caller User Name: <SBSSERVER>$
> Caller Domain: <DOMAINNAME>
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 8808
> Transited Services: -
> Source Network Address: 192.168.0.1
> Source Port: 62895
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 18/11/2009
> Time: 17:33:34
> User: NT AUTHORITY\SYSTEM
> Computer: <SBSSERVER>
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: <USER_A>
> Domain: <DOMAINNAME>
> Logon Type: 8
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: <SBSSERVER>
> Caller User Name: <SBSSERVER>$
> Caller Domain: <DOMAINNAME>
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 8808
> Transited Services: -
> Source Network Address: 192.168.0.1
> Source Port: 62895
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 18/11/2009
> Time: 17:33:35
> User: NT AUTHORITY\SYSTEM
> Computer: <SBSSERVER>
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: <USER_A>
> Domain: <DOMAINNAME>
> Logon Type: 8
> Logon Process: Advapi
> Authentication Package: Negotiate
> Workstation Name: <SBSSERVER>
> Caller User Name: <SBSSERVER>$
> Caller Domain: <DOMAINNAME>
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 8808
> Transited Services: -
> Source Network Address: 192.168.0.1
> Source Port: 62896
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> __________________________________________________ __________________________________________________ ___________
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 537
> Date: 18/11/2009
> Time: 17:33:36
> User: NT AUTHORITY\SYSTEM
> Computer: <SBSSERVER>
> Description:
> Logon Failure:
> Reason: An error occurred during logon
> User Name: <SBSSERVER>$
> Domain: <DOMAINNAME>.LOCAL
> Logon Type: 3
> Logon Process: Kerberos
> Authentication Package: Kerberos
> Workstation Name: -
> Status code: 0xC00000DC
> Substatus code: 0x0
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Information
> Event Source: Wins
> Event Category: None
> Event ID: 4098
> Date: 18/11/2009
> Time: 17:33:45
> User: N/A
> Computer: <SBSSERVER>
> Description:
> WINS was terminated by the service controller. WINS will gracefully
> terminate.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: b1 08 00 00 00 00 00 00 ±.......
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Information
> Event Source: EventLog
> Event Category: None
> Event ID: 6006
> Date: 18/11/2009
> Time: 17:33:45
> User: N/A
> Computer: <SBSSERVER>
> Description:
> The Event log service was stopped.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Information
> Event Source: EventLog
> Event Category: None
> Event ID: 6005
> Date: 18/11/2009
> Time: 17:39:32
> User: N/A
> Computer: <SBSSERVER>
> Description:
> The Event log service was started.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> <HEX Information Deleted>
>
> __________________________________________________ __________________________________________________ ___________
>
> Event Type: Error
> Event Source: Wins
> Event Category: None
> Event ID: 4224
> Date: 18/11/2009
> Time: 17:40:51
> User: N/A
> Computer: <SBSSERVER>
> Description:
> WINS encountered a database error. This may or may not be a serious error.
> WINS will try to recover from it. You can check the database error events
> under 'Application Log' category of the Event Viewer for the Exchange
> Component, ESENT, source to find out more details about database errors.
> If
> you continue to see a large number of these errors consistently over time
> (a
> span of few hours), you may want to restore the WINS database from a
> backup.
> The error number is in the second DWORD of the data section.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: a2 04 00 00 01 fc ff ff ¢....üÿÿ
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Error
> Event Source: Wins
> Event Category: None
> Event ID: 4318
> Date: 18/11/2009
> Time: 17:40:51
> User: N/A
> Computer: <SBSSERVER>
> Description:
> WINS could not start due to a missing or corrupt database. Restore the
> database using WINS Manager (or winscl.exe found in the Windows 2000
> Resource
> Kit) and restart WINS. If WINS still does not start, begin with a fresh
> copy
> of the database. To do this: 1) Delete all the files in the
> %%SystemRoot%%\system32\WINS directory. NOTE: If the WINS database
> file (typically named wins.mdb) is not in the above directory,
> check
> the registry for the full filepath. Delete the .mdb file.
> NOTE:
> If jet*.log are not in the above directory, check the registry for
> the
> directory path. Delete all log files 2) Restart WINS.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 8f 07 00 00 01 00 00 e0 Â�......Ã*
>
> __________________________________________________ __________________________________________________ ___________
> Event Type: Information
> Event Source: Wins
> Event Category: None
> Event ID: 4097
> Date: 18/11/2009
> Time: 17:46:53
> User: N/A
> Computer: <SBSSERVER>
> Description:
> WINS initialized properly and is now fully operational.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 6d 04 00 00 00 00 00 00 m.......
>
> __________________________________________________ __________________________________________________ ___________
>
>
>

Thanks for the reply.
Scheduled reboot was done to ensure that no services/tasks are failing after
the administrator password change.
Thanks
Gihan

"Dave Nickason [SBS MVP]" wrote:

> IMO, in the absence of ongoing symptoms, you can probably ignore these log
> entries. It's pretty common to get errors during a restart as various
> functions stop and start at different speeds.
>
> However, I would try to restart the server just to see if WINS fails to
> start again. I don't like to ignore startup failures like that, even those
> that are easy to fix by just manually starting the service. I'm concerned
> about running into a failure during an unexpected or unattended startup,
> such as a power failure, so if the service often fails to start without
> manual intervention, I'd probably want to fix that.
>
> What was the occasion for the scheduled reboot?
>
> "GihanZ" <> wrote in message
> news:BF02E874-6E69-4E15-94F3-...
> > Hi
> >
> > OS: SBS 2003R2 SP2
> >
> > Change Control Information: Administrator Password Changed on 17/11/09
> >
> > Issue Details:
> >
> > A schaduled reboot was done on the server on 18/11/09. After having a look
> > at the Event Logs once the system is back up I discovered KDC errors
> > (indicated below) just before the reboot and after the reboot was
> > initiated.
> > Further WINS did not startup after the reboot (errors indicated below).
> > But
> > manually going to services and starting the WINS worked without issues. I
> > am
> > concerned whether I need to take any actions for these errors or they are
> > possible one off errors caused by the time of authentication and the
> > reboot.
> > In the past I have never received these errors during a reboot. Currently
> > the
> > server is working and authenticating users with out issues.
> >
> > Appreciate your thoughts.
> >
> > Regards
> > Gihan
> >
> >
> > Event Log Sequence (From System and Security Logs):
> >
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Information
> > Event Source: USER32
> > Event Category: None
> > Event ID: 1074
> > Date: 18/11/2009
> > Time: 17:31:33
> > User: <DOMAINNAME>\<ADMINUSER>
> > Computer: <SBSSERVER>
> > Description:
> > The process explorer.exe has initiated the restart of computer <SBSSERVER>
> > on behalf of user <DOMAINNAME>\<ADMINUSER> for the following reason: Other
> > (Planned)
> > Reason Code: 0x85000000
> > Shutdown Type: restart
> > Comment: Maintenance Reboot. No WindowsUpdates installed.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > 0000: 00 00 00 85 ...Â…
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Error
> > Event Source: KDC
> > Event Category: None
> > Event ID: 7
> > Date: 18/11/2009
> > Time: 17:33:33
> > User: N/A
> > Computer: <SBSSERVER>
> > Description:
> > The Security Account Manager failed a KDC request in an unexpected way.
> > The
> > error is in the data field. The account name was <USER_A>@<DOMAINNAME> and
> > lookup type 0x20.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > 0000: 17 00 00 c0 ...À
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Error
> > Event Source: KDC
> > Event Category: None
> > Event ID: 7
> > Date: 18/11/2009
> > Time: 17:33:33
> > User: N/A
> > Computer: <SBSSERVER>
> > Description:
> > The Security Account Manager failed a KDC request in an unexpected way.
> > The
> > error is in the data field. The account name was <USER_A> and lookup type
> > 0x0.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > <HEX Information Deleted>
> > __________________________________________________ __________________________________________________ ___________
> >
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 529
> > Date: 18/11/2009
> > Time: 17:33:33
> > User: NT AUTHORITY\SYSTEM
> > Computer: <SBSSERVER>
> > Description:
> > Logon Failure:
> > Reason: Unknown user name or bad password
> > User Name: <USER_A>
> > Domain: <DOMAINNAME>
> > Logon Type: 8
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name: <SBSSERVER>
> > Caller User Name: <SBSSERVER>$
> > Caller Domain: <DOMAINNAME>
> > Caller Logon ID: (0x0,0x3E7)
> > Caller Process ID: 8808
> > Transited Services: -
> > Source Network Address: 192.168.0.1
> > Source Port: 62892
> >
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 529
> > Date: 18/11/2009
> > Time: 17:33:34
> > User: NT AUTHORITY\SYSTEM
> > Computer: <SBSSERVER>
> > Description:
> > Logon Failure:
> > Reason: Unknown user name or bad password
> > User Name: <USER_A>
> > Domain: <DOMAINNAME>
> > Logon Type: 8
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name: <SBSSERVER>
> > Caller User Name: <SBSSERVER>$
> > Caller Domain: <DOMAINNAME>
> > Caller Logon ID: (0x0,0x3E7)
> > Caller Process ID: 8808
> > Transited Services: -
> > Source Network Address: 192.168.0.1
> > Source Port: 62895
> >
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 529
> > Date: 18/11/2009
> > Time: 17:33:34
> > User: NT AUTHORITY\SYSTEM
> > Computer: <SBSSERVER>
> > Description:
> > Logon Failure:
> > Reason: Unknown user name or bad password
> > User Name: <USER_A>
> > Domain: <DOMAINNAME>
> > Logon Type: 8
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name: <SBSSERVER>
> > Caller User Name: <SBSSERVER>$
> > Caller Domain: <DOMAINNAME>
> > Caller Logon ID: (0x0,0x3E7)
> > Caller Process ID: 8808
> > Transited Services: -
> > Source Network Address: 192.168.0.1
> > Source Port: 62895
> >
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 529
> > Date: 18/11/2009
> > Time: 17:33:35
> > User: NT AUTHORITY\SYSTEM
> > Computer: <SBSSERVER>
> > Description:
> > Logon Failure:
> > Reason: Unknown user name or bad password
> > User Name: <USER_A>
> > Domain: <DOMAINNAME>
> > Logon Type: 8
> > Logon Process: Advapi
> > Authentication Package: Negotiate
> > Workstation Name: <SBSSERVER>
> > Caller User Name: <SBSSERVER>$
> > Caller Domain: <DOMAINNAME>
> > Caller Logon ID: (0x0,0x3E7)
> > Caller Process ID: 8808
> > Transited Services: -
> > Source Network Address: 192.168.0.1
> > Source Port: 62896
> >
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > __________________________________________________ __________________________________________________ ___________
> >
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 537
> > Date: 18/11/2009
> > Time: 17:33:36
> > User: NT AUTHORITY\SYSTEM
> > Computer: <SBSSERVER>
> > Description:
> > Logon Failure:
> > Reason: An error occurred during logon
> > User Name: <SBSSERVER>$
> > Domain: <DOMAINNAME>.LOCAL
> > Logon Type: 3
> > Logon Process: Kerberos
> > Authentication Package: Kerberos
> > Workstation Name: -
> > Status code: 0xC00000DC
> > Substatus code: 0x0
> > Caller User Name: -
> > Caller Domain: -
> > Caller Logon ID: -
> > Caller Process ID: -
> > Transited Services: -
> > Source Network Address: -
> > Source Port: -
> >
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Information
> > Event Source: Wins
> > Event Category: None
> > Event ID: 4098
> > Date: 18/11/2009
> > Time: 17:33:45
> > User: N/A
> > Computer: <SBSSERVER>
> > Description:
> > WINS was terminated by the service controller. WINS will gracefully
> > terminate.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > 0000: b1 08 00 00 00 00 00 00 ±.......
> >
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Information
> > Event Source: EventLog
> > Event Category: None
> > Event ID: 6006
> > Date: 18/11/2009
> > Time: 17:33:45
> > User: N/A
> > Computer: <SBSSERVER>
> > Description:
> > The Event log service was stopped.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> >
> > __________________________________________________ __________________________________________________ ___________
> > Event Type: Information
> > Event Source: EventLog
> > Event Category: None
> > Event ID: 6005
> > Date: 18/11/2009
> > Time: 17:39:32
> > User: N/A

Good idea to test that. I was wondering if the reboot might have been in
conjunction with patch installs - seems like sometimes installing a lot of
updates or whatever can add a little more activity to the next restart, and
that something like that might have caused the errors you saw.



"GihanZ" <> wrote in message
news:38C0D5FF-4133-474E-B15B-...
> Thanks for the reply.
> Scheduled reboot was done to ensure that no services/tasks are failing
> after
> the administrator password change.
> Thanks
> Gihan
>
> "Dave Nickason [SBS MVP]" wrote:
>
>> IMO, in the absence of ongoing symptoms, you can probably ignore these
>> log
>> entries. It's pretty common to get errors during a restart as various
>> functions stop and start at different speeds.
>>
>> However, I would try to restart the server just to see if WINS fails to
>> start again. I don't like to ignore startup failures like that, even
>> those
>> that are easy to fix by just manually starting the service. I'm
>> concerned
>> about running into a failure during an unexpected or unattended startup,
>> such as a power failure, so if the service often fails to start without
>> manual intervention, I'd probably want to fix that.
>>
>> What was the occasion for the scheduled reboot?
>>
>> "GihanZ" <> wrote in message
>> news:BF02E874-6E69-4E15-94F3-...
>> > Hi
>> >
>> > OS: SBS 2003R2 SP2
>> >
>> > Change Control Information: Administrator Password Changed on 17/11/09
>> >
>> > Issue Details:
>> >
>> > A schaduled reboot was done on the server on 18/11/09. After having a
>> > look
>> > at the Event Logs once the system is back up I discovered KDC errors
>> > (indicated below) just before the reboot and after the reboot was
>> > initiated.
>> > Further WINS did not startup after the reboot (errors indicated below).
>> > But
>> > manually going to services and starting the WINS worked without issues.
>> > I
>> > am
>> > concerned whether I need to take any actions for these errors or they
>> > are
>> > possible one off errors caused by the time of authentication and the
>> > reboot.
>> > In the past I have never received these errors during a reboot.
>> > Currently
>> > the
>> > server is working and authenticating users with out issues.
>> >
>> > Appreciate your thoughts.
>> >
>> > Regards
>> > Gihan
>> >
>> >
>> > Event Log Sequence (From System and Security Logs):
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Information
>> > Event Source: USER32
>> > Event Category: None
>> > Event ID: 1074
>> > Date: 18/11/2009
>> > Time: 17:31:33
>> > User: <DOMAINNAME>\<ADMINUSER>
>> > Computer: <SBSSERVER>
>> > Description:
>> > The process explorer.exe has initiated the restart of computer
>> > <SBSSERVER>
>> > on behalf of user <DOMAINNAME>\<ADMINUSER> for the following reason:
>> > Other
>> > (Planned)
>> > Reason Code: 0x85000000
>> > Shutdown Type: restart
>> > Comment: Maintenance Reboot. No WindowsUpdates installed.
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > Data:
>> > 0000: 00 00 00 85 ...Â…
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Error
>> > Event Source: KDC
>> > Event Category: None
>> > Event ID: 7
>> > Date: 18/11/2009
>> > Time: 17:33:33
>> > User: N/A
>> > Computer: <SBSSERVER>
>> > Description:
>> > The Security Account Manager failed a KDC request in an unexpected way.
>> > The
>> > error is in the data field. The account name was <USER_A>@<DOMAINNAME>
>> > and
>> > lookup type 0x20.
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > Data:
>> > 0000: 17 00 00 c0 ...À
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Error
>> > Event Source: KDC
>> > Event Category: None
>> > Event ID: 7
>> > Date: 18/11/2009
>> > Time: 17:33:33
>> > User: N/A
>> > Computer: <SBSSERVER>
>> > Description:
>> > The Security Account Manager failed a KDC request in an unexpected way.
>> > The
>> > error is in the data field. The account name was <USER_A> and lookup
>> > type
>> > 0x0.
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > Data:
>> > <HEX Information Deleted>
>> > __________________________________________________ __________________________________________________ ___________
>> >
>> > Event Type: Failure Audit
>> > Event Source: Security
>> > Event Category: Logon/Logoff
>> > Event ID: 529
>> > Date: 18/11/2009
>> > Time: 17:33:33
>> > User: NT AUTHORITY\SYSTEM
>> > Computer: <SBSSERVER>
>> > Description:
>> > Logon Failure:
>> > Reason: Unknown user name or bad password
>> > User Name: <USER_A>
>> > Domain: <DOMAINNAME>
>> > Logon Type: 8
>> > Logon Process: Advapi
>> > Authentication Package: Negotiate
>> > Workstation Name: <SBSSERVER>
>> > Caller User Name: <SBSSERVER>$
>> > Caller Domain: <DOMAINNAME>
>> > Caller Logon ID: (0x0,0x3E7)
>> > Caller Process ID: 8808
>> > Transited Services: -
>> > Source Network Address: 192.168.0.1
>> > Source Port: 62892
>> >
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Failure Audit
>> > Event Source: Security
>> > Event Category: Logon/Logoff
>> > Event ID: 529
>> > Date: 18/11/2009
>> > Time: 17:33:34
>> > User: NT AUTHORITY\SYSTEM
>> > Computer: <SBSSERVER>
>> > Description:
>> > Logon Failure:
>> > Reason: Unknown user name or bad password
>> > User Name: <USER_A>
>> > Domain: <DOMAINNAME>
>> > Logon Type: 8
>> > Logon Process: Advapi
>> > Authentication Package: Negotiate
>> > Workstation Name: <SBSSERVER>
>> > Caller User Name: <SBSSERVER>$
>> > Caller Domain: <DOMAINNAME>
>> > Caller Logon ID: (0x0,0x3E7)
>> > Caller Process ID: 8808
>> > Transited Services: -
>> > Source Network Address: 192.168.0.1
>> > Source Port: 62895
>> >
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Failure Audit
>> > Event Source: Security
>> > Event Category: Logon/Logoff
>> > Event ID: 529
>> > Date: 18/11/2009
>> > Time: 17:33:34
>> > User: NT AUTHORITY\SYSTEM
>> > Computer: <SBSSERVER>
>> > Description:
>> > Logon Failure:
>> > Reason: Unknown user name or bad password
>> > User Name: <USER_A>
>> > Domain: <DOMAINNAME>
>> > Logon Type: 8
>> > Logon Process: Advapi
>> > Authentication Package: Negotiate
>> > Workstation Name: <SBSSERVER>
>> > Caller User Name: <SBSSERVER>$
>> > Caller Domain: <DOMAINNAME>
>> > Caller Logon ID: (0x0,0x3E7)
>> > Caller Process ID: 8808
>> > Transited Services: -
>> > Source Network Address: 192.168.0.1
>> > Source Port: 62895
>> >
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Failure Audit
>> > Event Source: Security
>> > Event Category: Logon/Logoff
>> > Event ID: 529
>> > Date: 18/11/2009
>> > Time: 17:33:35
>> > User: NT AUTHORITY\SYSTEM
>> > Computer: <SBSSERVER>
>> > Description:
>> > Logon Failure:
>> > Reason: Unknown user name or bad password
>> > User Name: <USER_A>
>> > Domain: <DOMAINNAME>
>> > Logon Type: 8
>> > Logon Process: Advapi
>> > Authentication Package: Negotiate
>> > Workstation Name: <SBSSERVER>
>> > Caller User Name: <SBSSERVER>$
>> > Caller Domain: <DOMAINNAME>
>> > Caller Logon ID: (0x0,0x3E7)
>> > Caller Process ID: 8808
>> > Transited Services: -
>> > Source Network Address: 192.168.0.1
>> > Source Port: 62896
>> >
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> >
>> > Event Type: Failure Audit
>> > Event Source: Security
>> > Event Category: Logon/Logoff
>> > Event ID: 537
>> > Date: 18/11/2009
>> > Time: 17:33:36
>> > User: NT AUTHORITY\SYSTEM
>> > Computer: <SBSSERVER>
>> > Description:
>> > Logon Failure:
>> > Reason: An error occurred during logon
>> > User Name: <SBSSERVER>$
>> > Domain: <DOMAINNAME>.LOCAL
>> > Logon Type: 3
>> > Logon Process: Kerberos
>> > Authentication Package: Kerberos
>> > Workstation Name: -
>> > Status code: 0xC00000DC
>> > Substatus code: 0x0
>> > Caller User Name: -
>> > Caller Domain: -
>> > Caller Logon ID: -
>> > Caller Process ID: -
>> > Transited Services: -
>> > Source Network Address: -
>> > Source Port: -
>> >
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Information
>> > Event Source: Wins
>> > Event Category: None
>> > Event ID: 4098
>> > Date: 18/11/2009
>> > Time: 17:33:45
>> > User: N/A
>> > Computer: <SBSSERVER>
>> > Description:
>> > WINS was terminated by the service controller. WINS will gracefully
>> > terminate.
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > Data:
>> > 0000: b1 08 00 00 00 00 00 00 ±.......
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Information
>> > Event Source: EventLog
>> > Event Category: None
>> > Event ID: 6006
>> > Date: 18/11/2009
>> > Time: 17:33:45
>> > User: N/A
>> > Computer: <SBSSERVER>
>> > Description:
>> > The Event log service was stopped.
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > Data:
>> >
>> > __________________________________________________ __________________________________________________ ___________
>> > Event Type: Information
>> > Event Source: EventLog
>> > Event Category: None
>> > Event ID: 6005
>> > Date: 18/11/2009
>> > Time: 17:39:32
>> > User: N/A

Thanks for your thoughts. I shall keep an eye on those errors on the next
reboot.

"Dave Nickason [SBS MVP]" wrote:

> Good idea to test that. I was wondering if the reboot might have been in
> conjunction with patch installs - seems like sometimes installing a lot of
> updates or whatever can add a little more activity to the next restart, and
> that something like that might have caused the errors you saw.
>
>
>
> "GihanZ" <> wrote in message
> news:38C0D5FF-4133-474E-B15B-...
> > Thanks for the reply.
> > Scheduled reboot was done to ensure that no services/tasks are failing
> > after
> > the administrator password change.
> > Thanks
> > Gihan
> >
> > "Dave Nickason [SBS MVP]" wrote:
> >
> >> IMO, in the absence of ongoing symptoms, you can probably ignore these
> >> log
> >> entries. It's pretty common to get errors during a restart as various
> >> functions stop and start at different speeds.
> >>
> >> However, I would try to restart the server just to see if WINS fails to
> >> start again. I don't like to ignore startup failures like that, even
> >> those
> >> that are easy to fix by just manually starting the service. I'm
> >> concerned
> >> about running into a failure during an unexpected or unattended startup,
> >> such as a power failure, so if the service often fails to start without
> >> manual intervention, I'd probably want to fix that.
> >>
> >> What was the occasion for the scheduled reboot?
> >>
> >> "GihanZ" <> wrote in message
> >> news:BF02E874-6E69-4E15-94F3-...
> >> > Hi
> >> >
> >> > OS: SBS 2003R2 SP2
> >> >
> >> > Change Control Information: Administrator Password Changed on 17/11/09
> >> >
> >> > Issue Details:
> >> >
> >> > A schaduled reboot was done on the server on 18/11/09. After having a
> >> > look
> >> > at the Event Logs once the system is back up I discovered KDC errors
> >> > (indicated below) just before the reboot and after the reboot was
> >> > initiated.
> >> > Further WINS did not startup after the reboot (errors indicated below).
> >> > But
> >> > manually going to services and starting the WINS worked without issues.
> >> > I
> >> > am
> >> > concerned whether I need to take any actions for these errors or they
> >> > are
> >> > possible one off errors caused by the time of authentication and the
> >> > reboot.
> >> > In the past I have never received these errors during a reboot.
> >> > Currently
> >> > the
> >> > server is working and authenticating users with out issues.
> >> >
> >> > Appreciate your thoughts.
> >> >
> >> > Regards
> >> > Gihan
> >> >
> >> >
> >> > Event Log Sequence (From System and Security Logs):
> >> >
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Information
> >> > Event Source: USER32
> >> > Event Category: None
> >> > Event ID: 1074
> >> > Date: 18/11/2009
> >> > Time: 17:31:33
> >> > User: <DOMAINNAME>\<ADMINUSER>
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > The process explorer.exe has initiated the restart of computer
> >> > <SBSSERVER>
> >> > on behalf of user <DOMAINNAME>\<ADMINUSER> for the following reason:
> >> > Other
> >> > (Planned)
> >> > Reason Code: 0x85000000
> >> > Shutdown Type: restart
> >> > Comment: Maintenance Reboot. No WindowsUpdates installed.
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> > Data:
> >> > 0000: 00 00 00 85 ...Â…
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Error
> >> > Event Source: KDC
> >> > Event Category: None
> >> > Event ID: 7
> >> > Date: 18/11/2009
> >> > Time: 17:33:33
> >> > User: N/A
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > The Security Account Manager failed a KDC request in an unexpected way.
> >> > The
> >> > error is in the data field. The account name was <USER_A>@<DOMAINNAME>
> >> > and
> >> > lookup type 0x20.
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> > Data:
> >> > 0000: 17 00 00 c0 ...À
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Error
> >> > Event Source: KDC
> >> > Event Category: None
> >> > Event ID: 7
> >> > Date: 18/11/2009
> >> > Time: 17:33:33
> >> > User: N/A
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > The Security Account Manager failed a KDC request in an unexpected way.
> >> > The
> >> > error is in the data field. The account name was <USER_A> and lookup
> >> > type
> >> > 0x0.
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> > Data:
> >> > <HEX Information Deleted>
> >> > __________________________________________________ __________________________________________________ ___________
> >> >
> >> > Event Type: Failure Audit
> >> > Event Source: Security
> >> > Event Category: Logon/Logoff
> >> > Event ID: 529
> >> > Date: 18/11/2009
> >> > Time: 17:33:33
> >> > User: NT AUTHORITY\SYSTEM
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > Logon Failure:
> >> > Reason: Unknown user name or bad password
> >> > User Name: <USER_A>
> >> > Domain: <DOMAINNAME>
> >> > Logon Type: 8
> >> > Logon Process: Advapi
> >> > Authentication Package: Negotiate
> >> > Workstation Name: <SBSSERVER>
> >> > Caller User Name: <SBSSERVER>$
> >> > Caller Domain: <DOMAINNAME>
> >> > Caller Logon ID: (0x0,0x3E7)
> >> > Caller Process ID: 8808
> >> > Transited Services: -
> >> > Source Network Address: 192.168.0.1
> >> > Source Port: 62892
> >> >
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Failure Audit
> >> > Event Source: Security
> >> > Event Category: Logon/Logoff
> >> > Event ID: 529
> >> > Date: 18/11/2009
> >> > Time: 17:33:34
> >> > User: NT AUTHORITY\SYSTEM
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > Logon Failure:
> >> > Reason: Unknown user name or bad password
> >> > User Name: <USER_A>
> >> > Domain: <DOMAINNAME>
> >> > Logon Type: 8
> >> > Logon Process: Advapi
> >> > Authentication Package: Negotiate
> >> > Workstation Name: <SBSSERVER>
> >> > Caller User Name: <SBSSERVER>$
> >> > Caller Domain: <DOMAINNAME>
> >> > Caller Logon ID: (0x0,0x3E7)
> >> > Caller Process ID: 8808
> >> > Transited Services: -
> >> > Source Network Address: 192.168.0.1
> >> > Source Port: 62895
> >> >
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> >
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Failure Audit
> >> > Event Source: Security
> >> > Event Category: Logon/Logoff
> >> > Event ID: 529
> >> > Date: 18/11/2009
> >> > Time: 17:33:34
> >> > User: NT AUTHORITY\SYSTEM
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > Logon Failure:
> >> > Reason: Unknown user name or bad password
> >> > User Name: <USER_A>
> >> > Domain: <DOMAINNAME>
> >> > Logon Type: 8
> >> > Logon Process: Advapi
> >> > Authentication Package: Negotiate
> >> > Workstation Name: <SBSSERVER>
> >> > Caller User Name: <SBSSERVER>$
> >> > Caller Domain: <DOMAINNAME>
> >> > Caller Logon ID: (0x0,0x3E7)
> >> > Caller Process ID: 8808
> >> > Transited Services: -
> >> > Source Network Address: 192.168.0.1
> >> > Source Port: 62895
> >> >
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> >
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Failure Audit
> >> > Event Source: Security
> >> > Event Category: Logon/Logoff
> >> > Event ID: 529
> >> > Date: 18/11/2009
> >> > Time: 17:33:35
> >> > User: NT AUTHORITY\SYSTEM
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > Logon Failure:
> >> > Reason: Unknown user name or bad password
> >> > User Name: <USER_A>
> >> > Domain: <DOMAINNAME>
> >> > Logon Type: 8
> >> > Logon Process: Advapi
> >> > Authentication Package: Negotiate
> >> > Workstation Name: <SBSSERVER>
> >> > Caller User Name: <SBSSERVER>$
> >> > Caller Domain: <DOMAINNAME>
> >> > Caller Logon ID: (0x0,0x3E7)
> >> > Caller Process ID: 8808
> >> > Transited Services: -
> >> > Source Network Address: 192.168.0.1
> >> > Source Port: 62896
> >> >
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> >
> >> > __________________________________________________ __________________________________________________ ___________
> >> >
> >> > Event Type: Failure Audit
> >> > Event Source: Security
> >> > Event Category: Logon/Logoff
> >> > Event ID: 537
> >> > Date: 18/11/2009
> >> > Time: 17:33:36
> >> > User: NT AUTHORITY\SYSTEM
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > Logon Failure:
> >> > Reason: An error occurred during logon
> >> > User Name: <SBSSERVER>$
> >> > Domain: <DOMAINNAME>.LOCAL
> >> > Logon Type: 3
> >> > Logon Process: Kerberos
> >> > Authentication Package: Kerberos
> >> > Workstation Name: -
> >> > Status code: 0xC00000DC
> >> > Substatus code: 0x0
> >> > Caller User Name: -
> >> > Caller Domain: -
> >> > Caller Logon ID: -
> >> > Caller Process ID: -
> >> > Transited Services: -
> >> > Source Network Address: -
> >> > Source Port: -
> >> >
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> >
> >> > __________________________________________________ __________________________________________________ ___________
> >> > Event Type: Information
> >> > Event Source: Wins
> >> > Event Category: None
> >> > Event ID: 4098
> >> > Date: 18/11/2009
> >> > Time: 17:33:45
> >> > User: N/A
> >> > Computer: <SBSSERVER>
> >> > Description:
> >> > WINS was terminated by the service controller. WINS will gracefully
> >> > terminate.
> >> >