Error messages relating to domain server authorisation

Discussion in 'Windows Small Business Server' started by ophelaisys, Dec 5, 2005.

  1. ophelaisys

    ophelaisys Guest

    Help am going round in circles here with 2, which i think are related error
    messages in the system and security
    event logs

    The first pair occur in the system log every 20 mins 2gether... here they are

    Event Type: Warning
    Event Source: LSASRV
    Event Category: SPNEGO (Negotiator)
    Event ID: 40961
    Date: 05/12/2005
    Time: 12:26:05
    User: N/A
    Computer: SERVER1
    Description:
    The Security System could not establish a secured connection with the server
    DNS/server1.mydomain.local. No authentication protocol was available.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 6d 00 00 c0 m..À
    **********************************************************
    Event Type: Warning
    Event Source: LSASRV
    Event Category: SPNEGO (Negotiator)
    Event ID: 40960
    Date: 05/12/2005
    Time: 12:26:05
    User: N/A
    Computer: SERVER1
    Description:
    The Security System detected an authentication error for the server
    DNS/server1.mydomain.local. The failure code from authentication protocol
    Kerberos was "The attempted logon is invalid. This is either due to a bad
    username or authentication information.
    (0xc000006d)".

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 6d 00 00 c0 m..À
    *************************************************

    Then at regular intervals this failure audit appears in the security logs

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 529
    Date: 05/12/2005
    Time: 12:42:16
    User: NT AUTHORITY\SYSTEM
    Computer: SERVER1
    Description:
    Logon Failure:
    Reason: Unknown user name or bad password
    User Name: SERVER1$
    Domain: mydomain.local
    Logon Type: 3
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Workstation Name: SERVER1
    Caller User Name: -
    Caller Domain: -
    Caller Logon ID: -
    Caller Process ID: -
    Transited Services: -
    Source Network Address: -
    Source Port: -


    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    *******************************************88

    i cannot seem 2 find why my own SBS server ( server1) has this problem any
    help would be fantastic....

    DNS is fine all users can log on etc.... I do seem to ba having a few time
    out error on the server when i access new pages.... this is since i added a
    second network card a ran the internret connection wizard to put the lan and
    wan on 2 different cards?
     
    ophelaisys, Dec 5, 2005
    #1
    1. Advertisements

  2. Hello Ophelaisys,

    Thank you for posting in the SBS newsgroup.

    According to your description, I understand that you received these Event
    logs "Event Source: LSASRV, Event ID: 40961. Event Source: LSASRV, Event
    ID: 40960. Event Source: Security, Event ID: 529" in the SBS Server. If I
    have misunderstood the problem, please don't hesitate to let me know.

    To troubleshoot this issue, please kindly refer to the following
    information:

    I. As for Event logs "Event Source: LSASRV, Event ID: 40961. Event Source:
    LSASRV, Event ID: 40960"

    Based on my experience, this issue can occur when you restart the SBS 2003
    server that was promoted to a domain controller. A service, for example,
    the Windows Time service (W32Time), tries to authenticate before Directory
    Services has started. You can just safely ignore the event as it will not
    cause any adverse effects to the server. For more information, see:

    823712 Event IDs 40960 and 40961 in the System Event Log When You Restart
    http://support.microsoft.com/?id=823712

    824217 LSASRV Event IDs 40960 and 40961 When You Promote a Server to a
    Domain
    http://support.microsoft.com/?id=824217

    I would suggest you reboot the server again and see if the event does not
    appear.

    The issue could also be a similar to the problem described in the following
    KB article:

    826819 The Server Stops Responding and an Access Violation Occurs in
    Lsass.exe
    http://support.microsoft.com/?id=826819


    II. As for Event log "Event Source: Security, Event ID: 529"

    Based on my experience, this issue can occur if you enabled the "Audit
    logon event" policy enabled on the SBS server and a failure logon attempt
    is performed from the remote client. Security Event ID 529 is a failure
    audit for logon/logoff. It may be related to Exchange/IIS, client computer
    or inconsistent computer account password of the SBS 2003.

    I appreciate your time and cooperation. If anything is unclear, please feel
    free to let me know. I am looking forward to hearing from you.

    Best regards,

    Nathan Liu (MSFT)
    Microsoft CSS Online Newsgroup Support

    Get Secure! - www.microsoft.com/security
    ======================================================
    This newsgroup only focuses on SBS technical issues. If you have issues
    regarding other Microsoft products, you'd better post in the corresponding
    newsgroups so that they can be resolved in an efficient and timely manner.
    You can locate the newsgroup here:
    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

    When opening a new thread via the web interface, we recommend you check the
    "Notify me of replies" box to receive e-mail notifications when there are
    any updates in your thread. When responding to posts via your newsreader,
    please "Reply to Group" so that others may learn and benefit from your
    issue.

    Microsoft engineers can only focus on one issue per thread. Although we
    provide other information for your reference, we recommend you post
    different incidents in different threads to keep the thread clean. In doing
    so, it will ensure your issues are resolved in a timely manner.

    For urgent issues, you may want to contact Microsoft CSS directly. Please
    check http://support.microsoft.com for regional support phone numbers.

    Any input or comments in this thread are highly appreciated.
    ======================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.


    --------------------
     
    Nathan Liu [MSFT], Dec 6, 2005
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.