Announcement

Collapse
No announcement yet.

Any Kerberos experts out there?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Any Kerberos experts out there?

    I am finding tons of the following errors in my system log and security log. The system log error messages are because I turned on Kerberos logging. This issue has been ongoing for quite some time though I am not seeing any actual issues on my network. I also have a capture file I gathered using the MS Network Monitor software, I tried attaching here but had no luck, I put on rapidshare

    http://rapidshare.com/files/311412617/ker.cap.html

    My machine is a Windows 2003 SBS Standard edition box w/ SP2 installed. All of my clients sync time with my "SBSERVER" via GPO, I have another 2 other Windows 2003 Standard edition servers "NAVSERVER" & "FILESERVER"

    I am really at a loss with this, I have had a few other co-workers who have looked into this but couldn't come up with anything. I am 1 step away from a useless MS call but hoping maybe I could avoid that. Thanks in advance guys! Let me know if you need anymore information.
    Attached Files
    Be easy on me, I'm here to learn

  • #2
    Re: Any Kerberos experts out there?

    Hi,

    I would focus on the 537 event for now.

    The error code 0xC00002EE translates to "A security context was deleted before the context was completed. This is considered a logon failure"

    The event in question is logged for user UPS. Does he still exist and what its used for? service account etc?
    Are you getting these errors for other Users?
    Also how do the clients sync the time with the SBS via GPO?
    I am not quite sure in SBS domain but in an ordinary domain is the Time32 service that handles all the time sync in a hierarchical order with the PDC.

    As far as the kerberos event, it is logged as you said because the kerberos logging is enabled and i don't think it sheds much light.
    Caesar's cipher - 3

    ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

    SFX JNRS FC U6 MNGR

    Comment


    • #3
      Re: Any Kerberos experts out there?

      Are all your machines in the same time zone - including Automatically update for DST? And are they all synched timewise? And are they all up to date on the latest DST patches?
      Last edited by teiger; 24th November 2009, 12:21. Reason: DST Patches
      TIA

      Steven Teiger [SBS-MVP(2003-2009)]
      http://www.wintra.co.il/
      sigpic
      Iím honoured to have been selected for the SMB 150 list for 2013. This is the third time in succession (no logo available for 2011) that I have been honoured with this award.

      We donít stop playing because we grow old, we grow old because we stop playing.

      Comment


      • #4
        Re: Any Kerberos experts out there?

        Time was the first thing I checked because that is what I found regarding this issue. It is sync'ed via the GPO

        UPS is a general user account used on a couple different computers. I am getting this error for all users in the domain
        Be easy on me, I'm here to learn

        Comment


        • #5
          Re: Any Kerberos experts out there?

          Have a look at this post for similar issue: http://forums.msrportal.com/showthread.php?t=6117

          Could try resetting users profile to see if the errors reocurr.

          Also, others have reported that Network Monitoring clients and maybe third party firewalls have caused such events.
          Caesar's cipher - 3

          ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

          SFX JNRS FC U6 MNGR

          Comment


          • #6
            Re: Any Kerberos experts out there?

            Originally posted by L4ndy View Post
            Have a look at this post for similar issue: http://forums.msrportal.com/showthread.php?t=6117

            Could try resetting users profile to see if the errors reocurr.

            Also, others have reported that Network Monitoring clients and maybe third party firewalls have caused such events.
            Just read through it, I know that Marina from another forum and have no faith in her resolutions or posts, very generic. This is affecting every user account in my domain, to delete every users profile and reconfigure all there settings would take forever. Thank you for the link though, I just steer away from anything that person has ever recommend because it is not a true resolution to the problem. I would like to find out the actual cause.

            As far as firewalls I dont have any in my network, GPO has Windows Firewall disabled and no Networking monitoring going on, just to capture those packets really quick other than that it is disabled on my SBSERVER
            Be easy on me, I'm here to learn

            Comment


            • #7
              Re: Any Kerberos experts out there?

              Originally posted by brcmadmin View Post
              Just read through it, I know that Marina from another forum and have no faith in her resolutions or posts, very generic. This is affecting every user account in my domain, to delete every users profile and reconfigure all there settings would take forever. Thank you for the link though, I just steer away from anything that person has ever recommend because it is not a true resolution to the problem. I would like to find out the actual cause.
              Despite the fact that I do not know the person in question, I would disagree with your comments above for a few reasons :

              1- Her intentions I think, were to give someone a helping hand to the best of their abilities (Which applies to all of us) for FREE.
              Not everything is a "One answer" resolution, sometimes you got to go through troubleshooting steps to get to the bottom of the problem.

              2- She has got an MVP award for that product from MS and I personally treat any posts from MVPs with a bit of respect. I don't think MS just hands those awards out, you ve got to earn it.


              Good look with your troubleshooting
              Caesar's cipher - 3

              ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

              SFX JNRS FC U6 MNGR

              Comment


              • #8
                Re: Any Kerberos experts out there?

                THAT Marina is Marina Roos from the Netherlands; one of the magical M&Ms that own and run www.smallbizserver.net and a longstanding MVP. So respect her, and her answers - or she'll come around and beat you up
                Last edited by teiger; 30th November 2009, 21:23. Reason: Typo
                TIA

                Steven Teiger [SBS-MVP(2003-2009)]
                http://www.wintra.co.il/
                sigpic
                Iím honoured to have been selected for the SMB 150 list for 2013. This is the third time in succession (no logo available for 2011) that I have been honoured with this award.

                We donít stop playing because we grow old, we grow old because we stop playing.

                Comment

                Working...
                X