This is logged repeatedly... I've tried the Hotfix (2 each), they tell me that the hotfix is older than the service pack installed...I'm assuming SP/2 was supposed to take care of this. I've also tried MS's "resolution - work around".... by adding a Dword to the registry and a 15 min. value, and this also did not work. Does anyone have ANY IDEA how to fix this problem? Thanks in advance! jake ___________________________________________ Event Type:Failure AuditEvent Source:SecurityEvent Category:Account Logon Event ID:673Date:12/26/2007Time:6:09:58 AMUser:NT AUTHORITY\SYSTEMComputer:OurServerDescription:Service Ticket Request:User Name:User Domain:Service Name:Service ID:-Ticket Options:0x2Ticket Encryption Type:-Client Address:192.x.x.xFailure Code:0x20Logon GUID:-Transited Services:- For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I don't know if you have found a fix but I have the same error and have not found anything that works to fix it. If anyone has worked it out the info would be greatly appreciated.

Hi, The Event 673 with 0X20 error code indicates that the ticket presenting is expired. Typically when a user attempts to renew the ticket, the original ticket presenting may be invalid and be recognized as KRB_AP_ERR_TKT_EXPIRED. Normally this is an expected behavior and can be safely ignored. For this issue, I like to know: 1. When did the issue begin to happen? Did you change any settings before the issue occurred? Does the event appear on all the domain controllers? 2. Do you receive any other impact that is related to these events? For example, user account lockout?3. What is the 'User Name' that logged in the event? Is it a specific user or a couple of users that log this event?

Has anyone found a good answer for this? I'm having precisely the same report generated as the OP, there is no user name given which is probably why he didn't show it. It's been happening at our office for at least 4 months to the tune of 10-20 messages per day. Edit: SBS 2003 SP2, all clients are either XP SP3 or 2k SP4.

Hello, has anyone from Microsoft come up with an answer to this issue? This is happening on my network as well. No user name, just an IP and error code. It is causing user accounts to become locked out. Anyone???