No announcement yet.

Event ID 675 Unexplainable

  • Filter
  • Time
  • Show
Clear All
new posts

  • Event ID 675 Unexplainable

    Let me start by saying I have searched my butt off trying to fix this problem and I haven't found a solution. The problem is that I have two users constantly fill my event log with Failure Audit event 675 pre-authentication failed every 4 to 5 minutes. The event log lists the IP address and accounts used that failed. However, this is where it gets strange... The IP address displayed is a computer who is logged in and has always been used with a completely different user. So as an example the event will say:

    pre-authentication failed:
    User Name: John Doe
    User ID: DOMAIN\John Doe
    Service Name: krbtgt/DOMAIN
    Pre-Authentication Type: 0x2
    Failure Code: 0x18
    Client Address: x.x.1.112

    Except that x.x.1.112 is logged in as someone completely different right now, using their computer, John Doe has never ever logged into this computer, and John Doe is logged into his own computer on a different subnet right now yet it acts like he just tried to login on the x.x.1.112 computer. This same thing also happens with one other user.

    The clocks are in sync, I've tried not requiring pre-authentication in the user account properties, I've tried rejoining the computers to the domain, making the users log on and off, yet it still spams my event logs with these two users failing an audit every 4-5 minutes. I'll come into work in the morning and the event log will be full of this on the domain controller.

    We use Windows Server 2003 and Windows XP client machines. The problem came about when I turned on account auditing and lockouts and started noticing this.

    Does anyone have ANY suggestions or ideas?
    Last edited by Tyl0r; 10th July 2007, 21:06.

  • #2
    Re: Event ID 675 Unexplainable

    you might have already tried these but then again maybe not:
    Hope it helps some.
    I don't know anything about (you or your) computers.
    Research/test for yourself when listening to free advice.