Event ID's 40960+40961

  • Thread starter Thread starter Greg Gast
  • Start date Start date
G

Greg Gast

I'm getting two event ID's that have the net effect of dropping the secure
channel to my SBS 2003 server after 3 hours or so. This also drops the
connection to mapped drives. I can re-connect by logging off and on again,
but that gets to be a pain in the ***.

From this Dell Precision 360 XP Pro (sp1) box, the errors are:
Event ID 40960, Source LSASRV
"The Security System detected an attempted downgrade attack for server
exchangeRFR/JUPITER. The failure code from authentication protocol Kerberos
was "There are currently no logon servers available to service the logon
request. (0xc000005e)".

(I suspect this is also why Outlook 2003 keeps forgetting the password for
my Exchange account.)

The second event is:
Event ID 40961, Source LSASRV
"The Security System could not establish a secured connection with the
server exchangeRFR/JUPITER. No authentication protocol was available."

I apologise for the multiple posts. However, a search of the KB only had a
link to the MSFT XP support page, which wasn't any use. This didn't happen
when this same machine connected to a 2000 server box. I wanted to learn
Exchange, though.... <grin>

TIA
 
Thanks, vito!
I've cross-referenced them, and added the Kerberos SRV record to the reverse
lookup zone. Hopefully that fixes it. I'll test it again in a few hours. So
far, so good!

By the way, thanks for the link to eventid.net!
Greg
 
Back
Top