Audit Failures - Kerberos Authentication Service
In the last two hours there are over four thousand failure audits similar to this (client port number climbs incrementally by 1 each time) (edited domain and IP):
A Kerberos authentication ticket (TGT) was requested.
Account Information:
Account Name:
scanner
Supplied Realm Name:
#domain
User ID:
NULL SID
Service Information:
Service Name:
krbtgt/#Domain
Service ID:
NULL SID
Network Information:
Client Address:
10.10.10.20 #(changed for posting)
Client Port:
4197
Additional Information:
Ticket Options:
0x40810010
Result Code:
0x6
Ticket Encryption Type:
0xffffffff
Pre-Authentication Type: -
Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Certificate information is only provided if a certificate was used for pre-authentication.
Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
June 14th, 2011 11:15pm
have you read this?
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768
Free Windows Admin Tool Kit Click here and download it now
June 16th, 2011 1:17pm
This topic is archived. No further replies will be accepted.
Other recent topics
