Event ID 40960 + 40961 / SPNEGO

[Guest]

on a WinXP Pro (SP2, latest Patches, in an AD Domain, DC is a Win2003 Server)
the user account has been automatically locked .

I find the following Event ID´s


Event ID: 40690
Type: Warning
Usre: N/A
Source: LSASRV
Category: SPNEGO (Negotiator)

Description:
The Security System detected an attempted downgrade attack for server
cifs/SERVERNAME.DOMAINNAME.net. The failure code from authentication
protocol Kerberos was "The user account has been automatically locked because
too many invalid logon attempts or password change attempts have been
requested.
(0xc0000234)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------------------------------------

there is also a secon Event after 40960:

Event ID: 40691
Type: Warning
Usre: N/A
Source: LSASRV
Category: SPNEGO (Negotiator)

Description:
The Security System could not establish a secured connection with the server
cifs/SERVERNAME.DOMAINNAME.net. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Brian A]

DNS request for prisoner.iana.org

http://support.microsoft.com/default.aspx?scid=kb;en-us;259922



Event IDs 40960 and 40961 in the System Event Log When You Restart Windows Server
2003 After You Run Dcpromo.exe

http://support.microsoft.com/default.aspx?scid=kb;en-us;823712



LSASRV Event IDs 40960 and 40961 When You Promote a Server to a Domain Controller
Role

http://support.microsoft.com/default.aspx?scid=kb;en-us;824217



You cannot access network resources after you try to log on to a Windows XP Service
Pack 2-based computer

http://support.microsoft.com/default.aspx?scid=kb;en-us;885887



You cannot access resources after you install Security Bulletin MS04-011 or Windows
XP Service Pack 2

http://support.microsoft.com/default.aspx?scid=kb;en-us;891559

--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375

 

[Guest]

Sorry, but this articles doesn´t help... and this also do not describe the
same
Event Description.

Any other ideas?

 

[Kerry Brown]

The most common causes in the following link point to a problem with time
synchronization or misconfigured DNS.

http://www.eventid.net/display.asp?eventid=40960&eventno=787&source=LsaSrv&phase=1

 

[Guest]

I checked the Network Settings, looking for DNS entries (nslookup -q),
checked Network speed, flushed DNS Chache (ipconfig /flushdns), registered
new on DNS Server (ipconfig /registerdns), do netdom reset (netdom reset
COMPUTERNAME /DomainOMAINNAME.net)

Looks good. But some hours later, the same problem occurs.

The Event Description on
http://www.eventid.net/display.asp?eventid=40960&eventno=787&source=LsaSrv&phase=1
is not the same like mine.
So i think it is not really the same error.

 

[Kerry Brown]

Is this one closer?

http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1

Do you have reverse zones setup on your DNS server?

There's some more hints here:

http://www.eventid.net/display.asp?eventid=40961&eventno=1398&source=LsaSrv&phase=1