Windows Server - Pre-authentication events logged, but not lock-out or auth failure

Asked By cmhnz

03-Nov-09 10:33 AM

Hi all,

We've discovered that we are not receiving any event ID's 529, 531, 532
or 544 on our domain controllers.  These identify username/password
failure, account expired/disabled/locked out.

Instead, we are receiving pre-authentication failure events (ID 675)
with various Failure Codes which identify what the failure relates to.
This started happening a couple of months ago but has only just come to
light, and we are unsure why.  Failed logon attempts directly to the
domain controllers are logged with the specific ID (529 etc), but are
logged as ID 675 on any other workstation/server on the domain.

To my knowledge, no changes were implemented when this started
occurring, and although it appears failed logons are getting logged as
pre-authentication failures, this is not ideal as we use GFI
EventsManager to report on failed logins and really need the events
logged as their specific ID's (529, 531 etc).

Any help greatly appreciated.

Cheers,
Chris


--
cmhnz
------------------------------------------------------------------------
cmhnz's Profile: http://forums.techarena.in/members/151326.htm
View this thread: http://forums.techarena.in/active-directory/1266595.htm

http://forums.techarena.in

03-Nov-09 11:43 AM

Hi
Read this:
http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1

--
I hope that the information above helps you.
Have a Nice day.
Jorge Silva
MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

04-Nov-09 05:47 AM

Thanks for that page, it was interesting reading, but I could not find
anything that helped identify our problem.  One thing I forgot to
mention, which I am sure is not related, is our Security event logs on all
DC's had grown over the specified size of 65536kb and were about 250MB.
I have no idea how, so I reduced the size slightly and cleared the logs
and will see if they overwrite themselves as they are set to when they
reach the set limit.

Back to the event ID issue, this problem is affecting logon events to
all servers/workstations except our DC's.  If I attempt to logon
directly to a DC with the incorrect password, it records the correct ID
(529).  Any other machine on our domain records ID 675 with failure code
0x18.  If it was just a couple of machines then that would give me an
easier place to start, but because it is affecting all machines except
DCs it suggests to me a domain wide/DC problem.

We also do not seem to be receiving successful logon events either, ie.
no ID 528's but IDs 672 & 673 instead.

Any help appreciated.

Cheers,
Chris


--
cmhnz
------------------------------------------------------------------------
cmhnz's Profile: http://forums.techarena.in/members/151326.htm
View this thread: http://forums.techarena.in/active-directory/1266595.htm

http://forums.techarena.in

04-Nov-09 08:36 AM

I am unfamiliar with this specific issue, but I did some research and hear
are a couple of things to review:

http://support.microsoft.com/kb/328570

http://www.eventid.net/display.asp?eventid=675&eventno=62&source=Security&phase=1

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

04-Nov-09 10:39 AM

Thanks for your input, but the entries missing on the first link are
populated on the workstations, eg:

dNSHostName: workstation.dhcp.domain.co.uk
servicePrincipalName: HOST/workstation.dhcp.domain.co.uk
servicePrincipalName: HOST/WORKSTATION

I have read through the second link a couple of times, but could not find
anything that helped me resolve this issue.

I will keep hunting though.

Cheers,
Chris


--
cmhnz
------------------------------------------------------------------------
cmhnz's Profile: http://forums.techarena.in/members/151326.htm
View this thread: http://forums.techarena.in/active-directory/1266595.htm

http://forums.techarena.in