Security Event 675 every few seconds

[fenstrat]

I'm seeing the following security event every few seconds on the domain controller. The client IP address is actually the address of our library terminal server. I am not seeing anything strange on the terminal server though, does anyone know what might be causing this. It's only this one user causing the security event but there are about 100 users that use the terminal clients.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Date: 5/25/2004
Time: 7:30:39 AM
User: NT AUTHORITY\SYSTEM
Computer: PAN
Description:
Pre-authentication failed:
User Name: jmkeating
User ID: POLITY\jmkeating
Service Name: krbtgt/POLITY.SJCA.EDU
Pre-Authentication Type: 0x2
Failure Code: 0x18
Client Address: x.x.x.x

 

[fenstrat]

It is a pre-authentication failure event. Microsoft says it could be caused by an incorrect password, major time difference on the client, or smart card errors. We have an account lockout after 3 invalid attempts, the account is never locked out however. The computer time is correct and we are not using smart cards. Any other ideas?

 

[andrew2000]

Hey,
We have this same problem, were you ever able to solve it?

Andrew

 

[jimbuddy]

go to microsoft's website and download (nltest) and do the following.

nltest /sc_change_pwd:whatever.com then enter

whatever.com would be your url

hope this helps