Failure Code 0x18 for Computer accounts Expand / Collapse
Author
Message
Posted 11/3/2010 11:49:50 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 11/3/2010 9:44:38 PM
Posts: 2, Visits: 0
Hi,

May we ask your help on several audit failures also filling up our DC logs:

Log is from our Win2k DC:

User: SYSTEM
WinEvtLog: Security: AUDIT_FAILURE(675): Security: SYSTEM: NT AUTHORITY: DC: Pre-authentication failed: User Name: Workstation$ User ID: %{S-1-5-21-2995177579-405588783-4148359246-5627} Service Name: krbtgt/DOMAIN Pre-Authentication Type: 0x2 Failure Code: 0x18 Client Address: XXX.XXX.XXX.XXX

Just would like to ask what are the possible causes for this event.

Thanks in advance!
Post #506
Posted 11/3/2010 11:56:19 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 11/3/2010 9:44:38 PM
Posts: 2, Visits: 0
My apologies, I can't seem to edit my post but the server by the way is Win2k3 and not win2K.

Thank you!
Post #507
Posted 11/4/2010 5:33:18 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
0x18 of course means bad password.  If the user is a computer name which you indicate then it sounds like the computer's record of it's computer account password with the domain is out of sync with what is stored in Active Directory.  Is it a virtual machine that got roled back to an earlier snapshot or something similar in the physical world?  Look at the system and applicaiton log of the computer in question.
Post #508
Posted 12/30/2010 1:56:58 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/30/2010 3:52:58 AM
Posts: 1, Visits: 3
Hi Randy,

Good Day to you.

I am receving the below events so frequently, will you be able to help me to interpret this event.

Pre-authentication failed:
  User Name: xxxxxx
  User ID:  %{S-1-5-21-1715567821-746137067-839522115-1133}
  Service Name: krbtgt/xxxxxxx
  Pre-Authentication Type: 0x2
  Failure Code: 0x18
  Client Address: xx.xx.xxx.xx

Thanks in Advance

Franklin C

Post #546
Posted 2/10/2011 10:01:45 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Does the username end in a dollar sign?  If not it is simply a user trying to logon with a bad password
Post #582
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 1:56pm