Failure audit logged every 15 min

[MattT]

I was looking through my security logs and noticed this failure coming up
every 15mins. Any ideas?

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 673
Date: 11/7/2003
Time: 9:50:51 PM
User: NT AUTHORITY\SYSTEM
Computer: TS1
Description:
Service Ticket Request:
User Name:
User Domain: RETAILER.LOCAL
Service Name: host/ts1.retailer.local
Service ID: -
Ticket Options: 0x40830000
Ticket Encryption Type: -
Client Address: 127.0.0.1
Failure Code: 0xD
Logon GUID: -
Transited Services: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


\

 

[Ray Lava [MSFT]]

Matt,

The error that you provided in your newsgroup post indicates that the source
of the failure audit is that TS1 is making a kerberos request to itself
trying to use the service name of host/ts1.retailer.local. The most likely
reason for this failure is that it cannot resolve the service principal name
for hosts/ts1.retailer.local. This failure is not a problem since there is
no reason that it should need a kerberos ticket to itself. It is safe to
ignore this error.

If you want to make this error go away, you can make sure that the
"host/ts1.retailer.local" SPN is registered. You can do using adsiedit or
the setspn utility from the 2000 resource kit. If you use the setspn
utility the command will be "setspn -l ts1". This will dump all the SPNs
for TS1. You probably will not see host/ts1.retailer.local in the list.
You can do a "setspn -R TS1" to try to get it to reregister that SPN. If
this does not work, you can manually add this entry using adsiedit.

I hope this helps.

Ray Lava
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights