Good Day,

A few months ago we upgraded Backup Exec 2010 to 2014 after rebooting I noticed an odd error that now keeps coming up every night.  This server is a 2008R2 member server on a domain.  In the system log I now see the following error

Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos
Date:          6/23/2015 9:54:23 AM
Event ID:      4
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      HSUTIL.xxxxx
Description:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server ronremote64$. The target name used was cifs/amysmac.hspop.net. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (xxxx.NET) is different from the client domain (xxxx.NET), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Kerberos" Guid="{98E6CFCB-EE0A-41E0-A57B-622D4E1B30B1}" EventSourceName="Kerberos" />
    <EventID Qualifiers="16384">4</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-06-23T13:54:23.000000000Z" />
    <EventRecordID>34558</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>HSUTIL.xxxx.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="Server">ronremote64$</Data>
    <Data Name="TargetRealm">HSPOP.NET</Data>
    <Data Name="Targetname">cifs/amysmac.xxxx.net</Data>
    <Data Name="ClientRealm">xxxx.NET</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

This error is showing up for three other desktops on our domain.  I checked to see if the IP address are clean, they are.  Also made sure that there are no duplicate names and flushed the DNS and reset it again, not just on the server but also on the desktops. 

It talks about the SPN server principle name but what does this have to do with a desktop and there names?

Not sure why this is happening.  Any ideas would be helpful

Thank You,

Adam

Hi,

Thanks for your post.

When the Kerberos client tries to validate the authentication, the information he gets from Active Directory are different than the ones that is in the ticket.

Possible solution you have found:

Fixing the Security-Kerberos / 4 error

http://blogs.technet.com/b/dcaro/archive/2013/07/04/fixing-the-security-kerberos-4-error.aspx

Regards.

Thanks for the reply,

I did look at this in my search but was not sure that it appled to me.  Now after reviewing this further I am not sure that it does.

The SPN refers to software or management software though I did see some reference with SQL which may be related to Backup Exec as that has SQL and it did start happening after we upgraded so it upgraded the SQL database to a newer version.

I did run the base command setspn -L DOMANIN\sdkdomainuseraccount.  This was done on the server in question that it is happening to and I wanted to test this on one of our DC.  It shows that there are no SPN found with an error which I believe says You have none or so I believe.

I will speak to Backup Exec to see if this is an issue with the database and see where that takes this.

Adam

Hi,

I just want to confirm what is the current situation.

Please feel free to let us know if you need further assistance.

Regards.