Failure Audits

2003 Server displaying this message in Event Viewer.

Type: Failure Audit
Source: Security
Category: Account logon
Event ID: 673
User: System

I am also having the trouble with a 2000 Server but with a different Event
ID #. I found the solution I thought in the knowledge base and called
Microsoft for the hotfix, but it hasn't helped the problem. This is
effecting my logon scripts and Group Policy from processing. Thanks in
advance for any help.

If you can post the whole Event ID it may help. See the KB link below to
make sure your dns configuration is correct for the domain and run the
netdiag support tool on the domain controllers and domain computer that this
event is related to. Look for any failed tests/warnings/errors that may
indicate the problem. The support tools are on the install disk of the
appropriate operating system in the support tools folder. See the link below
for results for that error from EventID.net. --- Steve

http://www.eventid.net/display.asp?e...curity&phase=1


"Bobby28" <(E-Mail Removed)> wrote in message
news:32A03956-F79F-49F6-B86D-(E-Mail Removed)...
> 2003 Server displaying this message in Event Viewer.
>
> Type: Failure Audit
> Source: Security
> Category: Account logon
> Event ID: 673
> User: System
>
> I am also having the trouble with a 2000 Server but with a different Event
> ID #. I found the solution I thought in the knowledge base and called
> Microsoft for the hotfix, but it hasn't helped the problem. This is
> effecting my logon scripts and Group Policy from processing. Thanks in
> advance for any help.
>
>

Steven, thanks for the feedback. I have actually looked at the knowledge base
article where event 673 (2003 Server) and 677 (2000 Server) are continuously
logged in the event viewer. It described my problem almost to the T. However,
I contacted Microsoft for the hotfix and it did'nt help. The events are still
logged. I tried the netdiag and dcdiag yesterday, although I wasn't exactly
sure what I was looking at! I am new to the company and alot has been
neglected here, I only have 2 Servers here the 2000 and 2003. If you could
help with anymmore feedback or possibly what switches I could use for the
diagnostic tools I greatly appreciate it. Thanks,
Bobby

"Steven L Umbach" wrote:

> If you can post the whole Event ID it may help. See the KB link below to
> make sure your dns configuration is correct for the domain and run the
> netdiag support tool on the domain controllers and domain computer that this
> event is related to. Look for any failed tests/warnings/errors that may
> indicate the problem. The support tools are on the install disk of the
> appropriate operating system in the support tools folder. See the link below
> for results for that error from EventID.net. --- Steve
>
> http://www.eventid.net/display.asp?e...curity&phase=1
>
>
> "Bobby28" <(E-Mail Removed)> wrote in message
> news:32A03956-F79F-49F6-B86D-(E-Mail Removed)...
> > 2003 Server displaying this message in Event Viewer.
> >
> > Type: Failure Audit
> > Source: Security
> > Category: Account logon
> > Event ID: 673
> > User: System
> >
> > I am also having the trouble with a 2000 Server but with a different Event
> > ID #. I found the solution I thought in the knowledge base and called
> > Microsoft for the hotfix, but it hasn't helped the problem. This is
> > effecting my logon scripts and Group Policy from processing. Thanks in
> > advance for any help.
> >
> >
>
>
>

I see I forgot to provide the dns link. Proper dns configuration is critical
in an Active Directory domain and is always the first thing to check. The
domain controllers must point only to themselves and/or other domain
controllers as their preferred dns server in tcp/ip properties as shown by
ipconfig /all. Then W2K XP Pro/W2003 domain members must point only to
domain controllers [NEVER an ISP dns server] as their preferred dns servers.

http://support.microsoft.com/default...en-us%3B291382

If you have downlevel computers such as NT4.0/W98 in the domain it can be
normal to see logon failures in the security logs as they can not use
kerberos authentication. You could match up computer names to operating
systems to see if that is the case.

Netdiag and dcdiag are two extremely helpful tools for checking and
diagnosing network connectivity and domain configuration. I would first run
netdiag on the domain controller where you see these events and on one of
the domain computers that is showing as a failed logon. In particular for
netdiag look for failed tests, warnings, errors relating to dns, dc
discovery, kerberos, and secure channel. If you find any problems you can
paste into a reply here for us to take a look at to see if we can help. ---
Steve


"Bobby28" <(E-Mail Removed)> wrote in message
news:73680B64-DAA8-482F-8706-(E-Mail Removed)...
> Steven, thanks for the feedback. I have actually looked at the knowledge
> base
> article where event 673 (2003 Server) and 677 (2000 Server) are
> continuously
> logged in the event viewer. It described my problem almost to the T.
> However,
> I contacted Microsoft for the hotfix and it did'nt help. The events are
> still
> logged. I tried the netdiag and dcdiag yesterday, although I wasn't
> exactly
> sure what I was looking at! I am new to the company and alot has been
> neglected here, I only have 2 Servers here the 2000 and 2003. If you could
> help with anymmore feedback or possibly what switches I could use for the
> diagnostic tools I greatly appreciate it. Thanks,
> Bobby
>
> "Steven L Umbach" wrote:
>
>> If you can post the whole Event ID it may help. See the KB link below to
>> make sure your dns configuration is correct for the domain and run the
>> netdiag support tool on the domain controllers and domain computer that
>> this
>> event is related to. Look for any failed tests/warnings/errors that may
>> indicate the problem. The support tools are on the install disk of the
>> appropriate operating system in the support tools folder. See the link
>> below
>> for results for that error from EventID.net. --- Steve
>>
>> http://www.eventid.net/display.asp?e...curity&phase=1
>>
>>
>> "Bobby28" <(E-Mail Removed)> wrote in message
>> news:32A03956-F79F-49F6-B86D-(E-Mail Removed)...
>> > 2003 Server displaying this message in Event Viewer.
>> >
>> > Type: Failure Audit
>> > Source: Security
>> > Category: Account logon
>> > Event ID: 673
>> > User: System
>> >
>> > I am also having the trouble with a 2000 Server but with a different
>> > Event
>> > ID #. I found the solution I thought in the knowledge base and called
>> > Microsoft for the hotfix, but it hasn't helped the problem. This is
>> > effecting my logon scripts and Group Policy from processing. Thanks in
>> > advance for any help.
>> >
>> >
>>
>>
>>

http://support.microsoft.com/default...b;en-us;824905

Steve,
Thanks again for your response. The above link is the knowledge base article
that describes the problem I am having. DNS is configured correctly. The 2000
and 2003 Servers both point to themselves as the preferred DNS Servers. When
looking at the properties of the event failure, it is a problem with
kerberos(service ticket request) is what it says, however it doesn't give
much information. I am hesitant to upgrade the domain to native mode which
may help, even though we have no systems below Windows 2000. I am afraid
there may still be legacy applications that won't work, as we run AS400
mainframe with Domino Server. I am still learning the dcdiag and netdiag
commands. ???

"Steven L Umbach" wrote:

> I see I forgot to provide the dns link. Proper dns configuration is critical
> in an Active Directory domain and is always the first thing to check. The
> domain controllers must point only to themselves and/or other domain
> controllers as their preferred dns server in tcp/ip properties as shown by
> ipconfig /all. Then W2K XP Pro/W2003 domain members must point only to
> domain controllers [NEVER an ISP dns server] as their preferred dns servers.
>
> http://support.microsoft.com/default...en-us%3B291382
>
> If you have downlevel computers such as NT4.0/W98 in the domain it can be
> normal to see logon failures in the security logs as they can not use
> kerberos authentication. You could match up computer names to operating
> systems to see if that is the case.
>
> Netdiag and dcdiag are two extremely helpful tools for checking and
> diagnosing network connectivity and domain configuration. I would first run
> netdiag on the domain controller where you see these events and on one of
> the domain computers that is showing as a failed logon. In particular for
> netdiag look for failed tests, warnings, errors relating to dns, dc
> discovery, kerberos, and secure channel. If you find any problems you can
> paste into a reply here for us to take a look at to see if we can help. ---
> Steve
>
>
> "Bobby28" <(E-Mail Removed)> wrote in message
> news:73680B64-DAA8-482F-8706-(E-Mail Removed)...
> > Steven, thanks for the feedback. I have actually looked at the knowledge
> > base
> > article where event 673 (2003 Server) and 677 (2000 Server) are
> > continuously
> > logged in the event viewer. It described my problem almost to the T.
> > However,
> > I contacted Microsoft for the hotfix and it did'nt help. The events are
> > still
> > logged. I tried the netdiag and dcdiag yesterday, although I wasn't
> > exactly
> > sure what I was looking at! I am new to the company and alot has been
> > neglected here, I only have 2 Servers here the 2000 and 2003. If you could
> > help with anymmore feedback or possibly what switches I could use for the
> > diagnostic tools I greatly appreciate it. Thanks,
> > Bobby
> >
> > "Steven L Umbach" wrote:
> >
> >> If you can post the whole Event ID it may help. See the KB link below to
> >> make sure your dns configuration is correct for the domain and run the
> >> netdiag support tool on the domain controllers and domain computer that
> >> this
> >> event is related to. Look for any failed tests/warnings/errors that may
> >> indicate the problem. The support tools are on the install disk of the
> >> appropriate operating system in the support tools folder. See the link
> >> below
> >> for results for that error from EventID.net. --- Steve
> >>
> >> http://www.eventid.net/display.asp?e...curity&phase=1
> >>
> >>
> >> "Bobby28" <(E-Mail Removed)> wrote in message
> >> news:32A03956-F79F-49F6-B86D-(E-Mail Removed)...
> >> > 2003 Server displaying this message in Event Viewer.
> >> >
> >> > Type: Failure Audit
> >> > Source: Security
> >> > Category: Account logon
> >> > Event ID: 673
> >> > User: System
> >> >
> >> > I am also having the trouble with a 2000 Server but with a different
> >> > Event
> >> > ID #. I found the solution I thought in the knowledge base and called
> >> > Microsoft for the hotfix, but it hasn't helped the problem. This is
> >> > effecting my logon scripts and Group Policy from processing. Thanks in
> >> > advance for any help.
> >> >
> >> >
> >>
> >>
> >>
>
>
>

I have not seen that KB and thanks for the link to it. Since your dns is
configured correctly and if everything works well I would live with it and
not worry about those Event ID's. To raise a domain to Windows 2003 level,
all domain controllers must be Windows 2003 domain controllers anyhow. You
are wise as the old adage " if it ain't broke don't fix it " always
applies. --- Steve


"Bobby28" <(E-Mail Removed)> wrote in message
news:54FFA218-B98C-4AC4-9366-(E-Mail Removed)...
> http://support.microsoft.com/default...b;en-us;824905
>
> Steve,
> Thanks again for your response. The above link is the knowledge base
> article
> that describes the problem I am having. DNS is configured correctly. The
> 2000
> and 2003 Servers both point to themselves as the preferred DNS Servers.
> When
> looking at the properties of the event failure, it is a problem with
> kerberos(service ticket request) is what it says, however it doesn't give
> much information. I am hesitant to upgrade the domain to native mode which
> may help, even though we have no systems below Windows 2000. I am afraid
> there may still be legacy applications that won't work, as we run AS400
> mainframe with Domino Server. I am still learning the dcdiag and netdiag
> commands. ???
>
> "Steven L Umbach" wrote:
>
>> I see I forgot to provide the dns link. Proper dns configuration is
>> critical
>> in an Active Directory domain and is always the first thing to check. The
>> domain controllers must point only to themselves and/or other domain
>> controllers as their preferred dns server in tcp/ip properties as shown
>> by
>> ipconfig /all. Then W2K XP Pro/W2003 domain members must point only to
>> domain controllers [NEVER an ISP dns server] as their preferred dns
>> servers.
>>
>> http://support.microsoft.com/default...en-us%3B291382
>>
>> If you have downlevel computers such as NT4.0/W98 in the domain it can be
>> normal to see logon failures in the security logs as they can not use
>> kerberos authentication. You could match up computer names to operating
>> systems to see if that is the case.
>>
>> Netdiag and dcdiag are two extremely helpful tools for checking and
>> diagnosing network connectivity and domain configuration. I would first
>> run
>> netdiag on the domain controller where you see these events and on one of
>> the domain computers that is showing as a failed logon. In particular for
>> netdiag look for failed tests, warnings, errors relating to dns, dc
>> discovery, kerberos, and secure channel. If you find any problems you can
>> paste into a reply here for us to take a look at to see if we can
>> elp. ---
>> Steve
>>
>>
>> "Bobby28" <(E-Mail Removed)> wrote in message
>> news:73680B64-DAA8-482F-8706-(E-Mail Removed)...
>> > Steven, thanks for the feedback. I have actually looked at the
>> > knowledge
>> > base
>> > article where event 673 (2003 Server) and 677 (2000 Server) are
>> > continuously
>> > logged in the event viewer. It described my problem almost to the T.
>> > However,
>> > I contacted Microsoft for the hotfix and it did'nt help. The events are
>> > still
>> > logged. I tried the netdiag and dcdiag yesterday, although I wasn't
>> > exactly
>> > sure what I was looking at! I am new to the company and alot has been
>> > neglected here, I only have 2 Servers here the 2000 and 2003. If you
>> > could
>> > help with anymmore feedback or possibly what switches I could use for
>> > the
>> > diagnostic tools I greatly appreciate it. Thanks,
>> > Bobby
>> >
>> > "Steven L Umbach" wrote:
>> >
>> >> If you can post the whole Event ID it may help. See the KB link below
>> >> to
>> >> make sure your dns configuration is correct for the domain and run the
>> >> netdiag support tool on the domain controllers and domain computer
>> >> that
>> >> this
>> >> event is related to. Look for any failed tests/warnings/errors that
>> >> may
>> >> indicate the problem. The support tools are on the install disk of the
>> >> appropriate operating system in the support tools folder. See the link
>> >> below
>> >> for results for that error from EventID.net. --- Steve
>> >>
>> >> http://www.eventid.net/display.asp?e...curity&phase=1
>> >>
>> >>
>> >> "Bobby28" <(E-Mail Removed)> wrote in message
>> >> news:32A03956-F79F-49F6-B86D-(E-Mail Removed)...
>> >> > 2003 Server displaying this message in Event Viewer.
>> >> >
>> >> > Type: Failure Audit
>> >> > Source: Security
>> >> > Category: Account logon
>> >> > Event ID: 673
>> >> > User: System
>> >> >
>> >> > I am also having the trouble with a 2000 Server but with a different
>> >> > Event
>> >> > ID #. I found the solution I thought in the knowledge base and
>> >> > called
>> >> > Microsoft for the hotfix, but it hasn't helped the problem. This is
>> >> > effecting my logon scripts and Group Policy from processing. Thanks
>> >> > in
>> >> > advance for any help.
>> >> >
>> >> >
>> >>
>> >>
>> >>
>>
>>
>>

Yeah thats right. Hey if you would like to email me > (E-Mail Removed). I'm
always interested in what Network troubles Administrators encounter, and like
to help.

"Steven L Umbach" wrote:

> I have not seen that KB and thanks for the link to it. Since your dns is
> configured correctly and if everything works well I would live with it and
> not worry about those Event ID's. To raise a domain to Windows 2003 level,
> all domain controllers must be Windows 2003 domain controllers anyhow. You
> are wise as the old adage " if it ain't broke don't fix it " always
> applies. --- Steve
>
>
> "Bobby28" <(E-Mail Removed)> wrote in message
> news:54FFA218-B98C-4AC4-9366-(E-Mail Removed)...
> > http://support.microsoft.com/default...b;en-us;824905
> >
> > Steve,
> > Thanks again for your response. The above link is the knowledge base
> > article
> > that describes the problem I am having. DNS is configured correctly. The
> > 2000
> > and 2003 Servers both point to themselves as the preferred DNS Servers.
> > When
> > looking at the properties of the event failure, it is a problem with
> > kerberos(service ticket request) is what it says, however it doesn't give
> > much information. I am hesitant to upgrade the domain to native mode which
> > may help, even though we have no systems below Windows 2000. I am afraid
> > there may still be legacy applications that won't work, as we run AS400
> > mainframe with Domino Server. I am still learning the dcdiag and netdiag
> > commands. ???
> >
> > "Steven L Umbach" wrote:
> >
> >> I see I forgot to provide the dns link. Proper dns configuration is
> >> critical
> >> in an Active Directory domain and is always the first thing to check. The
> >> domain controllers must point only to themselves and/or other domain
> >> controllers as their preferred dns server in tcp/ip properties as shown
> >> by
> >> ipconfig /all. Then W2K XP Pro/W2003 domain members must point only to
> >> domain controllers [NEVER an ISP dns server] as their preferred dns
> >> servers.
> >>
> >> http://support.microsoft.com/default...en-us%3B291382
> >>
> >> If you have downlevel computers such as NT4.0/W98 in the domain it can be
> >> normal to see logon failures in the security logs as they can not use
> >> kerberos authentication. You could match up computer names to operating
> >> systems to see if that is the case.
> >>
> >> Netdiag and dcdiag are two extremely helpful tools for checking and
> >> diagnosing network connectivity and domain configuration. I would first
> >> run
> >> netdiag on the domain controller where you see these events and on one of
> >> the domain computers that is showing as a failed logon. In particular for
> >> netdiag look for failed tests, warnings, errors relating to dns, dc
> >> discovery, kerberos, and secure channel. If you find any problems you can
> >> paste into a reply here for us to take a look at to see if we can
> >> elp. ---
> >> Steve
> >>
> >>
> >> "Bobby28" <(E-Mail Removed)> wrote in message
> >> news:73680B64-DAA8-482F-8706-(E-Mail Removed)...
> >> > Steven, thanks for the feedback. I have actually looked at the
> >> > knowledge
> >> > base
> >> > article where event 673 (2003 Server) and 677 (2000 Server) are
> >> > continuously
> >> > logged in the event viewer. It described my problem almost to the T.
> >> > However,
> >> > I contacted Microsoft for the hotfix and it did'nt help. The events are
> >> > still
> >> > logged. I tried the netdiag and dcdiag yesterday, although I wasn't
> >> > exactly
> >> > sure what I was looking at! I am new to the company and alot has been
> >> > neglected here, I only have 2 Servers here the 2000 and 2003. If you
> >> > could
> >> > help with anymmore feedback or possibly what switches I could use for
> >> > the
> >> > diagnostic tools I greatly appreciate it. Thanks,
> >> > Bobby
> >> >
> >> > "Steven L Umbach" wrote:
> >> >
> >> >> If you can post the whole Event ID it may help. See the KB link below
> >> >> to
> >> >> make sure your dns configuration is correct for the domain and run the
> >> >> netdiag support tool on the domain controllers and domain computer
> >> >> that
> >> >> this
> >> >> event is related to. Look for any failed tests/warnings/errors that
> >> >> may
> >> >> indicate the problem. The support tools are on the install disk of the
> >> >> appropriate operating system in the support tools folder. See the link
> >> >> below
> >> >> for results for that error from EventID.net. --- Steve
> >> >>
> >> >> http://www.eventid.net/display.asp?e...curity&phase=1
> >> >>
> >> >>
> >> >> "Bobby28" <(E-Mail Removed)> wrote in message
> >> >> news:32A03956-F79F-49F6-B86D-(E-Mail Removed)...
> >> >> > 2003 Server displaying this message in Event Viewer.
> >> >> >
> >> >> > Type: Failure Audit
> >> >> > Source: Security
> >> >> > Category: Account logon
> >> >> > Event ID: 673
> >> >> > User: System
> >> >> >
> >> >> > I am also having the trouble with a 2000 Server but with a different
> >> >> > Event
> >> >> > ID #. I found the solution I thought in the knowledge base and
> >> >> > called
> >> >> > Microsoft for the hotfix, but it hasn't helped the problem. This is
> >> >> > effecting my logon scripts and Group Policy from processing. Thanks
> >> >> > in
> >> >> > advance for any help.
> >> >> >
> >> >> >
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>
>
>
>