I'm getting the following warning every 2 minutes in the security log on my
W2000 DC. I'm pretty sure the warning is being generated by a connection on
of my users is making to a remote server to access email for another company
he works for. How can I get this warning to stop? I currently have GP set
to audit account logon events pass/failure and audit logon events
pass/failure (I'd like to keep these settings if possible). Here is the
warning message being generated:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 676
Date: 5/18/2006
Time: 11:04:25 AM
User: NT AUTHORITY\SYSTEM
Computer: (SERVER NAME)
Description:
Authentication Ticket Request Failed:
User Name: username@remotedomain.com
Supplied Realm Name: OUR DOMAIN.COM
Service Name: krbtgt/OUR DOMAIN.COM
Ticket Options: 0x40810010
Failure Code: 0x6
Client Address: 192.168.221.17

Re: Failure Audits in Security Log by Roger

Roger
Thu May 18 20:45:19 CDT 2006

You probably need to speak with the person about configuration of
their client, for example you would see this if it was their email client
that was attempting to use the wrong credential when checking email
on the internal (your) email server.

"Aron Shevis" <AronShevis@discussions.microsoft.com> wrote in message
news:86CC9005-352B-45BB-B2DD-23880B50C88F@microsoft.com...
> I'm getting the following warning every 2 minutes in the security log on
> my
> W2000 DC. I'm pretty sure the warning is being generated by a connection
> on
> of my users is making to a remote server to access email for another
> company
> he works for. How can I get this warning to stop? I currently have GP
> set
> to audit account logon events pass/failure and audit logon events
> pass/failure (I'd like to keep these settings if possible). Here is the
> warning message being generated:
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 676
> Date: 5/18/2006
> Time: 11:04:25 AM
> User: NT AUTHORITY\SYSTEM
> Computer: (SERVER NAME)
> Description:
> Authentication Ticket Request Failed:
> User Name: username@remotedomain.com
> Supplied Realm Name: OUR DOMAIN.COM
> Service Name: krbtgt/OUR DOMAIN.COM
> Ticket Options: 0x40810010
> Failure Code: 0x6
> Client Address: 192.168.221.17
>
>