PCs Lock up every day at 5:45

[Drew Boillot]

Hello, I have a few PCs that are in use after hours that they seem to just,
lock up at 5:45 like clock work.

On all 3 of the PCs, i get errors like the following,


-----Start Error(s)
The Security System detected an attempted downgrade attack for server
cifs/ntserver. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon
request.

(0xc000005e)".

-------------------------------------

The Security System could not establish a secured connection with the server
cifs/ntserver. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

The browser was unable to retrieve a list of servers from the browser master
\\NTSERVER on the network
\Device\NetBT_Tcpip_{204C8C41-4DF3-4CD4-A0A3-70AE3CC277B2}. The data is the
error code.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

The Security System detected an attempted downgrade attack for server
cifs/DEDE. The failure code from authentication protocol Kerberos was "There
are currently no logon servers available to service the logon request.

(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

The Security System could not establish a secured connection with the server
cifs/DEDE. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----End Error(s)

now, ntserver is our 2003 Standard server w/ TS installed and running, the
"server" Dede is a winXP Pro PC. I'm not sure what is going on, but i see
these errors at the time the PCs get sluggish then locks up.

can anyone tell me what to do.. or at least where to start looking?

 

[Raoul]

If they consistantly lock up at the same time, the first thing I would look
at is the task scheduler to see if anything is scheduled to run at that time
of day.

Hello, I have a few PCs that are in use after hours that they seem to just,
lock up at 5:45 like clock work.

On all 3 of the PCs, i get errors like the following,


-----Start Error(s)
The Security System detected an attempted downgrade attack for server
cifs/ntserver. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon
request.

(0xc000005e)".

-------------------------------------

The Security System could not establish a secured connection with the server
cifs/ntserver. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

The browser was unable to retrieve a list of servers from the browser master
\\NTSERVER on the network
\Device\NetBT_Tcpip_{204C8C41-4DF3-4CD4-A0A3-70AE3CC277B2}. The data is the
error code.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

The Security System detected an attempted downgrade attack for server
cifs/DEDE. The failure code from authentication protocol Kerberos was "There
are currently no logon servers available to service the logon request.

(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

The Security System could not establish a secured connection with the server
cifs/DEDE. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----End Error(s)

now, ntserver is our 2003 Standard server w/ TS installed and running, the
"server" Dede is a winXP Pro PC. I'm not sure what is going on, but i see
these errors at the time the PCs get sluggish then locks up.

can anyone tell me what to do.. or at least where to start looking?

 

[Karl]

Try this webpage:
http://www.eventid.net/display.asp?eventid=40960&eventno=787&source=LsaSrv&phase=1

or this info form Microsoft
http://support.microsoft.com/kb/139410/EN-US/

 

[Drew Boillot]

This is the first thing I tried. I even changed the antivirus scan times.
I will try the things suggested in the next post Monday.

Thanks