* URGENT * Windows XP SPNEGO (Negotiator)

[M. T]

I am getting a new event that apparently is causing the
following issue: I log onto the domain at 8:00am, within
a matter of a few hours, I have to logoff and then back
on...due to being prompted for a l/p for LAN shared
files/folders. Most of the LAN is Windows 2000, but we
do have 2 boxes running XP Pro. that also have these same
issues. Below is the actual event that writes:

EVENT #1

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/8/2004
Time: 8:53:01 AM
User: N/A
Computer: N/A
Description:
The Security System could not establish a secured
connection with the server cifs/PSC.
No authentication protocol was available.

EVENT #2

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 6/7/2004
Time: 10:33:52 PM
User: N/A
Computer: N/A
Description:
The Security System detected an attempted downgrade
attack for server DOMAIN\PDC$. The failure code from
authentication protocol Kerberos was "There are currently
no logon servers available to service the logon request.
(0xc000005e)"


Any help with this would be GREAT. As I have tried to
search around, but no such luck.


MUCH Thanks in advance.

 

[Ken Wickes [MSFT]]

Looks like you lost connectivity to the DCs. Any reason to believe it's not
as simple as that?

 

[M. T]

Well, it does seem kind of odd that ONLY my XP boxes are
doing the same thing. and the other 30+ Win2k boxes are
just fine. My box and the other XP box are located on
different end of the building...actually, they go to
different switchs too. Any further thoughts?

-----Original Message-----
Looks like you lost connectivity to the DCs. Any reason to believe it's not
as simple as that?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

I am getting a new event that apparently is causing the
following issue: I log onto the domain at 8:00am, within
a matter of a few hours, I have to logoff and then back
on...due to being prompted for a l/p for LAN shared
files/folders. Most of the LAN is Windows 2000, but we
do have 2 boxes running XP Pro. that also have these same
issues. Below is the actual event that writes:

EVENT #1

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/8/2004
Time: 8:53:01 AM
User: N/A
Computer: N/A
Description:
The Security System could not establish a secured
connection with the server cifs/PSC.
No authentication protocol was available.

EVENT #2

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 6/7/2004
Time: 10:33:52 PM
User: N/A
Computer: N/A
Description:
The Security System detected an attempted downgrade
attack for server DOMAIN\PDC$. The failure code from
authentication protocol Kerberos was "There are currently
no logon servers available to service the logon request.
(0xc000005e)"


Any help with this would be GREAT. As I have tried to
search around, but no such luck.


MUCH Thanks in advance.

.

 

[Ken Wickes [MSFT]]

OK, I hadn't understood the the 2K boxes were unaffected.

When this occurs, are you able to ping the DCs from the affected machine?

Are you expert enough to get a network trace and see if auth requests are
going to the DCs?

Is your network running IPSEC? IPv6?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Well, it does seem kind of odd that ONLY my XP boxes are
doing the same thing. and the other 30+ Win2k boxes are
just fine. My box and the other XP box are located on
different end of the building...actually, they go to
different switchs too. Any further thoughts?

-----Original Message-----
Looks like you lost connectivity to the DCs. Any reason to believe it's not
as simple as that?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

I am getting a new event that apparently is causing the
following issue: I log onto the domain at 8:00am, within
a matter of a few hours, I have to logoff and then back
on...due to being prompted for a l/p for LAN shared
files/folders. Most of the LAN is Windows 2000, but we
do have 2 boxes running XP Pro. that also have these same
issues. Below is the actual event that writes:

EVENT #1

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/8/2004
Time: 8:53:01 AM
User: N/A
Computer: N/A
Description:
The Security System could not establish a secured
connection with the server cifs/PSC.
No authentication protocol was available.

EVENT #2

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 6/7/2004
Time: 10:33:52 PM
User: N/A
Computer: N/A
Description:
The Security System detected an attempted downgrade
attack for server DOMAIN\PDC$. The failure code from
authentication protocol Kerberos was "There are currently
no logon servers available to service the logon request.
(0xc000005e)"


Any help with this would be GREAT. As I have tried to
search around, but no such luck.


MUCH Thanks in advance.

.

 

[Guest]

I'm now seeing this same issue and same messages...With 2 XP boxes that were fine over the year until last week. Other XP boxes are fine. I can ping the server but Tracert hangs. In addition, I cannot seem to use 'remote desktop connection' from this workstation to the server while the 'occurance' is in effect. Reboot seems to clear the problem for an hour or so, then it's back again.

It does appear to be some kind of connectivity issue but not a normal one of poor cable, loose connection, etc. Affects Outlook 2K3, SQL2K apps.

Has any additional info come to light on this?

thanks

OK, I hadn't understood the the 2K boxes were unaffected.

When this occurs, are you able to ping the DCs from the affected machine?

Are you expert enough to get a network trace and see if auth requests are
going to the DCs?

Is your network running IPSEC? IPv6?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Well, it does seem kind of odd that ONLY my XP boxes are
doing the same thing. and the other 30+ Win2k boxes are
just fine. My box and the other XP box are located on
different end of the building...actually, they go to
different switchs too. Any further thoughts?

-----Original Message-----
Looks like you lost connectivity to the DCs. Any reason to believe it's not
as simple as that?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


I am getting a new event that apparently is causing the
following issue: I log onto the domain at 8:00am, within
a matter of a few hours, I have to logoff and then back
on...due to being prompted for a l/p for LAN shared
files/folders. Most of the LAN is Windows 2000, but we
do have 2 boxes running XP Pro. that also have these same
issues. Below is the actual event that writes:

EVENT #1

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/8/2004
Time: 8:53:01 AM
User: N/A
Computer: N/A
Description:
The Security System could not establish a secured
connection with the server cifs/PSC.
No authentication protocol was available.

EVENT #2

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 6/7/2004
Time: 10:33:52 PM
User: N/A
Computer: N/A
Description:
The Security System detected an attempted downgrade
attack for server DOMAIN\PDC$. The failure code from
authentication protocol Kerberos was "There are currently
no logon servers available to service the logon request.
(0xc000005e)"


Any help with this would be GREAT. As I have tried to
search around, but no such luck.


MUCH Thanks in advance.


.

 

[Ken Wickes [MSFT]]

Not that I know of. Does tracert work the rest of the time? When it hangs,
does it hang right away or does it display the first hop?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

I'm now seeing this same issue and same messages...With 2 XP boxes that

were fine over the year until last week. Other XP boxes are fine. I can
ping the server but Tracert hangs. In addition, I cannot seem to use
'remote desktop connection' from this workstation to the server while the
'occurance' is in effect. Reboot seems to clear the problem for an hour or
so, then it's back again.

It does appear to be some kind of connectivity issue but not a normal one

of poor cable, loose connection, etc. Affects Outlook 2K3, SQL2K apps.

Has any additional info come to light on this?

thanks

OK, I hadn't understood the the 2K boxes were unaffected.

When this occurs, are you able to ping the DCs from the affected machine?

Are you expert enough to get a network trace and see if auth requests are
going to the DCs?

Is your network running IPSEC? IPv6?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Well, it does seem kind of odd that ONLY my XP boxes are
doing the same thing. and the other 30+ Win2k boxes are
just fine. My box and the other XP box are located on
different end of the building...actually, they go to
different switchs too. Any further thoughts?
-----Original Message-----
Looks like you lost connectivity to the DCs. Any reason
to believe it's not
as simple as that?

--

Ken Wickes [MSFT]
This posting is provided "AS IS" with no warranties, and
confers no rights.


message
I am getting a new event that apparently is causing the
following issue: I log onto the domain at 8:00am,
within
a matter of a few hours, I have to logoff and then back
on...due to being prompted for a l/p for LAN shared
files/folders. Most of the LAN is Windows 2000, but we
do have 2 boxes running XP Pro. that also have these
same
issues. Below is the actual event that writes:

EVENT #1

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/8/2004
Time: 8:53:01 AM
User: N/A
Computer: N/A
Description:
The Security System could not establish a secured
connection with the server cifs/PSC.
No authentication protocol was available.

EVENT #2

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 6/7/2004
Time: 10:33:52 PM
User: N/A
Computer: N/A
Description:
The Security System detected an attempted downgrade
attack for server DOMAIN\PDC$. The failure code from
authentication protocol Kerberos was "There are
currently
no logon servers available to service the logon
request.
(0xc000005e)"


Any help with this would be GREAT. As I have tried to
search around, but no such luck.


MUCH Thanks in advance.


.