Event ID 3172 and Event ID 2000 on Windows 2003SP1 Server

Discussion in 'Windows Server' started by Johnny Wright, Jul 3, 2005.

  1. A recent look through the event viewer shows that I am getting the following
    2 events about 2 times every minute. The events started at 9:03 am on June
    18 2005. This server is a domain controller that is used very little,
    simply for DHCP, DNS and some file storage. I have looked and there are no
    time restrictions for any users. Although I have pasted one of the events
    below for event id 3172, it is going to many different users.
    Any help would be appreciated.

    Event ID #1 (3172)
    There was an error sending the alert message - ( From: Server at \\Server1
    To: 192.168.0.11
    Subj: ** USER NOTIFICATION **
    Date: 7/2/2005 9:04 PM
    Your logon time at Domain1 has ended.
    ) The error code is 123.

    Event #2 (2000)
    The server's call to a system service failed unexpectedly.
     
    Johnny Wright, Jul 3, 2005
    #1
    1. Advertisements

  2. Event id 3172 source system:
    http://snipurl.com/g09e

    Event id 2000 source ncpserver:
    http://snipurl.com/g095

    --
    ---
    Giuseppe Nacci
    Microsoft Certified System Engineer
    Security Manager

    --------------------------------------------------------------------
    CONFIDENTIALITY NOTICE
    This message and its attachments are addressed solely to the persons
    above and may contain confidential information. If you have received
    the message in error, be informed that any use of the content hereof
    is prohibited. Please return it immediately to the sender and delete
    the message. Should you have any questions, please contact us by
    replying to
    Thank you
    --------------------------------------------------------------------
     
    Giuseppe Nacci, Jul 3, 2005
    #2
    1. Advertisements

  3. Thank you for your reply. I have read the links that you sent, however
    regarding event id 3271, all of the accounts do exist and more importantly I
    am concerned as to why the message is being sent in the first place. I do
    not have any time restriction on any users so the message that says "Your
    logon time at Domain1 has ended" should not exist.
    Any ideas why this message would be being sent to my users?

    Thanks.
     
    Johnny Wright, Jul 3, 2005
    #3
  4. Looking about Kerberos policy/Maximum lifetime for user ticket and Maximum
    lifetime for service ticket in GPO.
    How many time is setted?
    --
    ---
    Giuseppe Nacci
    Microsoft Certified System Engineer
    Security Manager

    --------------------------------------------------------------------
    CONFIDENTIALITY NOTICE
    This message and its attachments are addressed solely to the persons
    above and may contain confidential information. If you have received
    the message in error, be informed that any use of the content hereof
    is prohibited. Please return it immediately to the sender and delete
    the message. Should you have any questions, please contact us by
    replying to
    Thank you
    --------------------------------------------------------------------
     
    Giuseppe Nacci, Jul 4, 2005
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.