Failed event ID 672

[TheMisio]

Dear Colleauges,

I have been getting loads of failed events 672 on our Windows 2003 SP1 domain controllers.
There are virtually no information about failed 672 events out there (plenty on successful ones though).

An example:

Authentication Ticket Request:
User Name: Jo Blog
Supplied Realm Name: MYDOMAIN
User ID: -
Service Name: krbtgt/MYDOMAIN
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: xxx.xxx.xxx.xxx
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:

Does anyone know what does thismean?

Regards,

Michael

 

[sparkbyte]

672: Authentication Ticket Granted

At the beginning of the day when a user sits down at his or her workstation and enters his domain username and password, the workstation contacts a local DC and requests a TGT. If the username and password are correct and the user account passes status and restriction checks, the DC grants the TGT and logs event ID 672 (authentication ticket granted). The User field for this event (and all other events in the Audit account logon event category) doesn't help you determine who the user was; the field always reads SYSTEM. Rather look at the User Name and Supplied Realm Name fields, which identify the user who logged on and the user account's DNS suffix. The User ID field provides the same information in NT style.

So you seem to have domain user objects failing to get their Authorization Tickets.

Look to see if it is the same user or set of users. Not sure but you may need to recreaate the user accounts.



Thanks

John Fuhrman
Titan Global Services

http://www.titangs.com

faq329-6766

 

[TheMisio]

sparkbyte,

Thank you for the reply.

I’m getting these for many users. Nor real pattern here.
The thing is that I would expect events 675 for these users as well, but there aren’t any. Users are able to log on no probs.

Also, there is nothing in the affected the workstations’ log security log.

Weird.

Thanks anyway.

Michael.