Events 675 676 677

[John]

Getting these security audit failures in log.

Event 675
Pre-authentication failed:
User Name: username
User ID: Domain\username
Service Name: krbtgt/Domain
Pre-Authentication Type: 0x2
Failure Code: 0x18
Client Address: 172.16.0.70

Event 676
Authentication Ticket Request Failed:
User Name: username
Supplied Realm Name: Domain
Service Name: krbtgt/Domain
Ticket Options: 0x40810010
Failure Code: 0x6
Client Address: 172.16.0.50

Event 677
Service Ticket Request Failed:
User Name: username$
User Domain: Domain.COM
Service Name: krbtgt/Domain.COM
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 172.16.0.80

Any help would be appreciated.

 

[Steven L Umbach]

Are those IP addresses from computers in your network and in the domain and are they
W2K/XP Pro computers? Did this just happen recently? Are these events from a domain
controller? For starts verify that these computers are in synch with the domain
controller as far as timewise and that your dns configuration for the domain is
correct in that domain controllers point only to themselves or pdc fsmo as their
preferred dns controller and that domain members point only to domain controllers as
their preferred dns server. --- Steve