Help am going round in circles here with 2, which i think are related error messages in the system and security event logs The first pair occur in the system log every 20 mins 2gether... here they are Event Type: Warning Event Source: LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40961 Date: 05/12/2005 Time: 12:26:05 User: N/A Computer: SERVER1 Description: The Security System could not establish a secured connection with the server DNS/server1.mydomain.local. No authentication protocol was available. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 6d 00 00 c0 m..À ********************************************************** Event Type: Warning Event Source: LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40960 Date: 05/12/2005 Time: 12:26:05 User: N/A Computer: SERVER1 Description: The Security System detected an authentication error for the server DNS/server1.mydomain.local. The failure code from authentication protocol Kerberos was "The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)". For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 6d 00 00 c0 m..À ************************************************* Then at regular intervals this failure audit appears in the security logs Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: 05/12/2005 Time: 12:42:16 User: NT AUTHORITY\SYSTEM Computer: SERVER1 Description: Logon Failure: Reason: Unknown user name or bad password User Name: SERVER1$ Domain: mydomain.local Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: SERVER1 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. *******************************************88 i cannot seem 2 find why my own SBS server ( server1) has this problem any help would be fantastic.... DNS is fine all users can log on etc.... I do seem to ba having a few time out error on the server when i access new pages.... this is since i added a second network card a ran the internret connection wizard to put the lan and wan on 2 different cards?
Hello Ophelaisys, Thank you for posting in the SBS newsgroup. According to your description, I understand that you received these Event logs "Event Source: LSASRV, Event ID: 40961. Event Source: LSASRV, Event ID: 40960. Event Source: Security, Event ID: 529" in the SBS Server. If I have misunderstood the problem, please don't hesitate to let me know. To troubleshoot this issue, please kindly refer to the following information: I. As for Event logs "Event Source: LSASRV, Event ID: 40961. Event Source: LSASRV, Event ID: 40960" Based on my experience, this issue can occur when you restart the SBS 2003 server that was promoted to a domain controller. A service, for example, the Windows Time service (W32Time), tries to authenticate before Directory Services has started. You can just safely ignore the event as it will not cause any adverse effects to the server. For more information, see: 823712 Event IDs 40960 and 40961 in the System Event Log When You Restart http://support.microsoft.com/?id=823712 824217 LSASRV Event IDs 40960 and 40961 When You Promote a Server to a Domain http://support.microsoft.com/?id=824217 I would suggest you reboot the server again and see if the event does not appear. The issue could also be a similar to the problem described in the following KB article: 826819 The Server Stops Responding and an Access Violation Occurs in Lsass.exe http://support.microsoft.com/?id=826819 II. As for Event log "Event Source: Security, Event ID: 529" Based on my experience, this issue can occur if you enabled the "Audit logon event" policy enabled on the SBS server and a failure logon attempt is performed from the remote client. Security Event ID 529 is a failure audit for logon/logoff. It may be related to Exchange/IIS, client computer or inconsistent computer account password of the SBS 2003. I appreciate your time and cooperation. If anything is unclear, please feel free to let me know. I am looking forward to hearing from you. Best regards, Nathan Liu (MSFT) Microsoft CSS Online Newsgroup Support Get Secure! - www.microsoft.com/security ====================================================== This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities/newsgroups/en-us/default.aspx When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue. Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner. For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers. Any input or comments in this thread are highly appreciated. ====================================================== This posting is provided "AS IS" with no warranties, and confers no rights. --------------------
