Kerberos Event ID 4 messages and NT4

[JamieS]

There are many postings on these forums regarding the Kerberos event
id 4 error messages, but no one seems to be mentioning them with
relation to Windows NT4 workstations running on the network. I get a
ton of these messages stating:

Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 4
Date: 8/22/2003
Time: 8:24:48 AM
User: N/A
Computer: My_Server_Name
Description:
The function InitializeSecurityContext received a Kerberos Error
Message:
on logon session
Client Time:
Server Time: 13:24:48.0000 8/22/2003 (null)
Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
Client Realm:
Client Name:
Server Realm: My_Domain_Name.COM
Server Name: krbtgt/My_Domain_Name.COM
Target Name: HOST/Host_Name@My_Domain_Name.COM
Error Text:
File:
Line:
Error Data is in record data.

This error occurs on our PDC emulator many times throughout the day
and somewhat less on our other domain controllers. The target name is
always related to any one our NT4 workstations. It does not occur with
pre-NT4 workstations. I understand the problem that the dc cannot
grant a kerberos ticket to a pre-Win2k machine as obviously pre-Win2K
does not support kerberos. I also know that if kerberos authentication
fails, it will fail over to ntlm. This is why users do not actually
report any problems. Why however is this error not being generated by
any Windows 9x clients? The reports on www.eventid.net tell me that I
can ignore these errors when it pertains to a downlevel client, but is
there any way to prevent the messages from being generated. This has
not always been a problem.

Thanks,

 

[Eric Chamberlain]

Pre NT clients do not join the domain, so there is no SPN for them in the
directory

 

[Steven L Umbach]

I do not know of anyway to eliminate the messages, however the reason
you do not see it for W9X computers is because they do not have [nor can
have] computer accounts in the domain. --- Steve