Security Basics mailing list archives
Failure Audit for Event id 675
From: rs <rsmade () gmail com>
Date: Mon, 17 Apr 2006 16:48:47 -0400
I am receiving a ton of Event 675 Failure Audits on my DC. Windows 2003 Mixed mode Domain and this is the pdc emulator. The bulk of these are arriving as follows:
Event Type: Failure Audit Event Source: Security Event Category: Account Logon Event ID: 675 Date: 4/17/2006 Time: 4:38:56 PM User: NT AUTHORITY\SYSTEM Computer: DC01 Description: Pre-authentication failed: User Name: Admin User ID: OURDOMAIN\Admin Service Name: krbtgt/OURDOMAIN Pre-Authentication Type: 0x2 Failure Code: 0x18 Client Address: 127.0.0.1I can't identify any process using this account on the DC. A reboot did not solve the issue. A lot of searching on the we has pointed to time issues dealing with kerberos but that does not seem to be it. The strange part is the client address being 127.0.0.1. Could this just be a virus out on our network reporting 127.0.0.1 as its source during authentication attempts? Has anyone seen anything like this?
------------------------------------------------------------------------- This List Sponsored by: WebrootDon't leave your confidential company and customer records un-protected. Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no obligation. See why so many companies trust Spy Sweeper Enterprise to eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise http://www.webroot.com/forms/enterprise_lead.php --------------------------------------------------------------------------
Current thread:
- Failure Audit for Event id 675 rs (Apr 18)
- <Possible follow-ups>
- RE: Failure Audit for Event id 675 Tyler, Grayling (Apr 18)
- Re: Failure Audit for Event id 675 rs (Apr 19)
- Re: Failure Audit for Event id 675 Dana Hudnall (Apr 20)
- Re: Failure Audit for Event id 675 ilaiy (Apr 21)
- Re: Failure Audit for Event id 675 Philippe De Ryck (Apr 21)
- Re: Failure Audit for Event id 675 rs (Apr 19)