Security of Server

[Felix Monclova]

Hi,

Has anyone experienced this event code and issue?

"The Security System detected an attempted downgrade
attack for server (My Server's Name). The failure code
from authentication protocol Kerberos was "There are
currently no logon servers available to service the logon
request.
(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp."

Thanks in advance,

Felix Monclova

 

[Curtis Koenig [MSFT]]

Hi Felix,
The first thing to check is that you have the server pointed to itself for
DNS (if it is a DNS server) or to an authorzed DNS server for your domain
and not the DNS of your ISP or other DNS server. If this does not resolve
the issue you may want to consider checking the settings for dynamic DNS
registration.
--
Curtis Koenig
Support Professional
Microsoft Clustering Technologies Support

Microsoft Certified Systems Engineer
Microsoft Certified Systems Engineer - Security

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!
--------------------

 

[Roger Abell]

Hi,

Has anyone experienced this event code and issue?

"The Security System detected an attempted downgrade
attack for server (My Server's Name). The failure code
from authentication protocol Kerberos was "There are
currently no logon servers available to service the logon
request.
(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp."

Thanks in advance,

Felix Monclova

Assumption : you sporadically catch one or a few of these
in the security event log

Yes, I occassionally catch these or related/similar events on
world net exposed interfaces on server version of W2k.
I have chalked them off to connection attempts by Kerberos
aware systems in untrusted realms or intentional probes.
This assumption could easily be wrong, but it settles the unease.
They are very infrequent, and where seen in the context described
are wholely unrelated to any AD DNS needs. The IPs have most
often been ascribed to old USSR countries or deep Asia when I
have bothered to look further.