Event 4771

[pinkpanther56]

I'm still trying to get the hang of the 2008 event log. Can anyone help with this event in my security log. My DC's periodically log a faliure event and they always come in groups of four every few hours. As far as I can tell they're working fine.

Kerberos pre-authentication failed.

Account Information:
	Security ID:		BCS\SERVER1$
	Account Name:		SERVER1$

Service Information:
	Service Name:		krbtgt/DOMAIN.UK

Network Information:
	Client Address:		::ffff:10.*.*.*
	Client Port:		64277

Additional Information:
	Ticket Options:		0x40810010
	Failure Code:		0x18
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number: 	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

All DC's are Server 2008 SP2

Thanks.

 

[pinkpanther56]

Looking at this article here it suggests that the computer account password might need to be reset using netdom.

http://chicagotech.net/netforums/viewtopic.php?t=4853

Could this be the case?

Thanks.

 

[pinkpanther56]

Update. Only one of our DC's log this error and it's every 8 hours the other two DC's seem to be fine.

Computer account password problem?

Can anyone comment?

Thanks.