Security Event Log: Event ID 675
The information in this article applies to:
- GFI EventsManager 7
- GFI EventsManager 8
- GFI LANguard Security Event Log Monitor 3
- GFI LANguard Security Event Log Monitor 4
- GFI LANguard Security Event Log Monitor 5
Article ID: KBID001736
Description:
- Pre-authentication failed:
User Name: %1
User ID: %2
Service Name: %3
Pre-Authentication Type: %4
Failure Code: %5
Client Address: %6
Importance:
- High
- Someone attempted to logon with a valid account but invalid password.
Detailed Description:
This event may be generated when there is a problem with DNS records. It is recommended that you check the DNS records and verify if machine name and IP address are correct. Netdiag.exe is a useful tool to diagnose these problems.
This event was reported when one finds his account locked out suddenly on Win2000 networks after changing his domain password. Ensure that you are not logged on another Win2000 machine (apart from the one from which you changed your password). The system tries to renew the Kerberos ticket using the old password and fails.
This event is generated when a user attempts to log on at a Windows 2000 Pro workstation and uses a valid domain account name but enters a bad password. The DC records the event (pre-authentication failed) with Failure Code 24 (or 0x18). By reviewing each of your DC Security logs for this event and failure code, you can track every domain logon attempt that failed as a result of a bad password. In addition to providing the username and domain name, the event provides the IP address of the system from which the logon attempt originated.
Windows 2000 also logs this event when a user attempts to use a different username (i.e. a username other than the one he or she used for the current workstation logon) to connect to a server.
Possible Causes of this event:
(1) Due to problems with DNS records.
(2) After changing your domain password on Win2000 networks. The system tries to renew the Kerberos ticket using the old password and fails.
(3) This event log with Failure Code 24 (or 0x18) may be logged when a user attempts to log on at a Windows 2000 Pro workstation with valid domain account name but bad password.
More Information:
Legend: Logon Failure Error Codes