LSASRV; Event ID: 40968
in [Windows Servers]
|
Prev: Error 333
Next: wbemess.log
From: Tariq Azad on 15 Mar 2006 11:04 Michael- Are there other events like event 6033 or 50? Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... I know that LSASRV has some known issues. Please check the following link to see if it applies in your case. http://support.microsoft.com/default.aspx?scid=kb;en-us;818080 http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx Regards, Tariq Azad "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:839A2818-305F-404F-A62D-4D101E6368F5(a)microsoft.com... Tariq: I know that you didn't ask me for this information, but I'm going to post it anyway. Microsoft Windows 2003 SP1 (5.2.3790) All current updates/hotfixes are installed onto the server. This server is configured for DC, DNS, DHCP, File/Print. With a default installation, no tweaks have been applied to this server at this time whereas it is a fresh install. Thanks in advance for your help! "Tariq Azad" wrote: > George- > > Thanks for posting your message here. > Is it a warning or an error? Please provide some more information including: > OS Version > Server Pack Version > > Regards, > > Tariq Azad > > "George" <George(a)discussions.microsoft.com> wrote in message news:0A6F3483-DE66-4D20-886E-D8224EB37954(a)microsoft.com... > I am having same problem followed by the following restart. > > The process winlogon.exe has initiated the restart of computer FS1 on behalf > of user for the following reason: No title for this reason could be found > > Reason Code: 0x50006 > > Shutdown Type: restart > > Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated > unexpectedly with status code -1073740972. The system will now shut down and > restart. > > > "Michael Easterly" wrote: > > > Source: LSASRV > > Castegory: SPNEGO (Negotiator) > > Event ID: 40968 > > > > The Security System has received an authentication request that could not be > > decoded. The request has failed. > > > > I can't find a reference for this Warning anywhere, please help. > > > >
From: Michael Easterly on 15 Mar 2006 11:34 Tariq- The only warning event that is coming up is 40968. The only event that is being logged for time synchronization is informational; Source: W32TIME Event ID: 37 The time provider NtpClient is currently receiving valid time data from ntp.uiuc.edu (ntp.m|0x1|131.230.210.129:123->130.126.24.24:123). I set this up according to Article ID : 816042. Configuring the Windows Time service to use an external time source. I have also successfully synchronized other hosts to the DC as well. This is the first DC in domain. "Tariq Azad" wrote: > Michael- > > Are there other events like event 6033 or 50? Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... > > I know that LSASRV has some known issues. Please check the following link to see if it applies in your case. > http://support.microsoft.com/default.aspx?scid=kb;en-us;818080 > http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx > > Regards, > > Tariq Azad > "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:839A2818-305F-404F-A62D-4D101E6368F5(a)microsoft.com... > Tariq: > > I know that you didn't ask me for this information, but I'm going to post it > anyway. > > Microsoft Windows 2003 SP1 (5.2.3790) > > All current updates/hotfixes are installed onto the server. This server is > configured for DC, DNS, DHCP, File/Print. With a default installation, no > tweaks have been applied to this server at this time whereas it is a fresh > install. > > Thanks in advance for your help! > > "Tariq Azad" wrote: > > > George- > > > > Thanks for posting your message here. > > Is it a warning or an error? Please provide some more information including: > > OS Version > > Server Pack Version > > > > Regards, > > > > Tariq Azad > > > > "George" <George(a)discussions.microsoft.com> wrote in message news:0A6F3483-DE66-4D20-886E-D8224EB37954(a)microsoft.com... > > I am having same problem followed by the following restart. > > > > The process winlogon.exe has initiated the restart of computer FS1 on behalf > > of user for the following reason: No title for this reason could be found > > > > Reason Code: 0x50006 > > > > Shutdown Type: restart > > > > Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated > > unexpectedly with status code -1073740972. The system will now shut down and > > restart. > > > > > > "Michael Easterly" wrote: > > > > > Source: LSASRV > > > Castegory: SPNEGO (Negotiator) > > > Event ID: 40968 > > > > > > The Security System has received an authentication request that could not be > > > decoded. The request has failed. > > > > > > I can't find a reference for this Warning anywhere, please help. > > > > > >
From: Michael Easterly on 15 Mar 2006 11:51 I checked out the articles that you included with your last posting. The first article does not apply becuase the server is not logging events 1015 or 1000 as the article indicates. The second article doesn't apply either. Whereas SP1 includes 835732, (http://www.microsoft.com/technet/security/prodtech/windowsserver2003/sp1.mspx) I ran the baseline security analyser to see what hotfixes are installed and below are the results (Scanned with MBSA version: 2.0.5029.2): MS05-036 Security Update for Windows Server 2003 (KB901214) MS05-039 Security Update for Windows Server 2003 (KB899588) MS05-040 Security Update for Windows Server 2003 (KB893756) MS05-033 Security Update for Windows Server 2003 (KB896428) MS05-027 Security Update for Windows Server 2003 (KB896422) MS05-026 Security Update for Windows Server 2003 (KB896358) MS05-042 Security Update for Windows Server 2003 (KB899587) MS05-032 Security Update for Windows Server 2003 (KB890046) MS05-041 Security Update for Windows Server 2003 (KB899591) MS05-045 Security Update for Windows Server 2003 (KB905414) MS05-051 Security Update for Windows Server 2003 (KB902400) MS05-046 Security Update for Windows Server 2003 (KB899589) MS05-048 Security Update for Windows Server 2003 (KB901017) MS05-049 Security Update for Windows Server 2003 (KB900725) MS05-053 Security Update for Windows Server 2003 (KB896424) MS05-050 Security Update for Windows Server 2003 (KB904706) MS05-054 Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB905915) MS06-001 Security Update for Windows Server 2003 (KB912919) MS06-002 Security Update for Windows Server 2003 (KB908519) MS06-008 Security Update for Windows Server 2003 (KB911927) MS06-009 Security Update for Windows Server 2003 (KB901190) MS06-006 Security Update for Windows Media Player Plug-in (KB911564) MS06-007 Security Update for Windows Server 2003 (KB913446) 890830 Windows Malicious Software Removal Tool - March 2006 (KB890830) Thanks in advance for your assistance. "Tariq Azad" wrote: > Michael- > > Are there other events like event 6033 or 50? Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... > > I know that LSASRV has some known issues. Please check the following link to see if it applies in your case. > http://support.microsoft.com/default.aspx?scid=kb;en-us;818080 > http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx > > Regards, > > Tariq Azad > "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:839A2818-305F-404F-A62D-4D101E6368F5(a)microsoft.com... > Tariq: > > I know that you didn't ask me for this information, but I'm going to post it > anyway. > > Microsoft Windows 2003 SP1 (5.2.3790) > > All current updates/hotfixes are installed onto the server. This server is > configured for DC, DNS, DHCP, File/Print. With a default installation, no > tweaks have been applied to this server at this time whereas it is a fresh > install. > > Thanks in advance for your help! > > "Tariq Azad" wrote: > > > George- > > > > Thanks for posting your message here. > > Is it a warning or an error? Please provide some more information including: > > OS Version > > Server Pack Version > > > > Regards, > > > > Tariq Azad > > > > "George" <George(a)discussions.microsoft.com> wrote in message news:0A6F3483-DE66-4D20-886E-D8224EB37954(a)microsoft.com... > > I am having same problem followed by the following restart. > > > > The process winlogon.exe has initiated the restart of computer FS1 on behalf > > of user for the following reason: No title for this reason could be found > > > > Reason Code: 0x50006 > > > > Shutdown Type: restart > > > > Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated > > unexpectedly with status code -1073740972. The system will now shut down and > > restart. > > > > > > "Michael Easterly" wrote: > > > > > Source: LSASRV > > > Castegory: SPNEGO (Negotiator) > > > Event ID: 40968 > > > > > > The Security System has received an authentication request that could not be > > > decoded. The request has failed. > > > > > > I can't find a reference for this Warning anywhere, please help. > > > > > >
From: Tariq Azad on 15 Mar 2006 11:59 Michael- Thanks for a prompt reply. I didn't get answers of my other questions. Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... Regards, Tariq "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:862C950F-6654-4870-BE2D-DEA5703E7670(a)microsoft.com... I checked out the articles that you included with your last posting. The first article does not apply becuase the server is not logging events 1015 or 1000 as the article indicates. The second article doesn't apply either. Whereas SP1 includes 835732, (http://www.microsoft.com/technet/security/prodtech/windowsserver2003/sp1..mspx) I ran the baseline security analyser to see what hotfixes are installed and below are the results (Scanned with MBSA version: 2.0.5029.2): MS05-036 Security Update for Windows Server 2003 (KB901214) MS05-039 Security Update for Windows Server 2003 (KB899588) MS05-040 Security Update for Windows Server 2003 (KB893756) MS05-033 Security Update for Windows Server 2003 (KB896428) MS05-027 Security Update for Windows Server 2003 (KB896422) MS05-026 Security Update for Windows Server 2003 (KB896358) MS05-042 Security Update for Windows Server 2003 (KB899587) MS05-032 Security Update for Windows Server 2003 (KB890046) MS05-041 Security Update for Windows Server 2003 (KB899591) MS05-045 Security Update for Windows Server 2003 (KB905414) MS05-051 Security Update for Windows Server 2003 (KB902400) MS05-046 Security Update for Windows Server 2003 (KB899589) MS05-048 Security Update for Windows Server 2003 (KB901017) MS05-049 Security Update for Windows Server 2003 (KB900725) MS05-053 Security Update for Windows Server 2003 (KB896424) MS05-050 Security Update for Windows Server 2003 (KB904706) MS05-054 Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB905915) MS06-001 Security Update for Windows Server 2003 (KB912919) MS06-002 Security Update for Windows Server 2003 (KB908519) MS06-008 Security Update for Windows Server 2003 (KB911927) MS06-009 Security Update for Windows Server 2003 (KB901190) MS06-006 Security Update for Windows Media Player Plug-in (KB911564) MS06-007 Security Update for Windows Server 2003 (KB913446) 890830 Windows Malicious Software Removal Tool - March 2006 (KB890830) Thanks in advance for your assistance. "Tariq Azad" wrote: > Michael- > > Are there other events like event 6033 or 50? Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... > > I know that LSASRV has some known issues. Please check the following link to see if it applies in your case. > http://support.microsoft.com/default.aspx?scid=kb;en-us;818080 > http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx > > Regards, > > Tariq Azad > "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:839A2818-305F-404F-A62D-4D101E6368F5(a)microsoft.com... > Tariq: > > I know that you didn't ask me for this information, but I'm going to post it > anyway. > > Microsoft Windows 2003 SP1 (5.2.3790) > > All current updates/hotfixes are installed onto the server. This server is > configured for DC, DNS, DHCP, File/Print. With a default installation, no > tweaks have been applied to this server at this time whereas it is a fresh > install. > > Thanks in advance for your help! > > "Tariq Azad" wrote: > > > George- > > > > Thanks for posting your message here. > > Is it a warning or an error? Please provide some more information including: > > OS Version > > Server Pack Version > > > > Regards, > > > > Tariq Azad > > > > "George" <George(a)discussions.microsoft.com> wrote in message news:0A6F3483-DE66-4D20-886E-D8224EB37954(a)microsoft.com... > > I am having same problem followed by the following restart. > > > > The process winlogon.exe has initiated the restart of computer FS1 on behalf > > of user for the following reason: No title for this reason could be found > > > > Reason Code: 0x50006 > > > > Shutdown Type: restart > > > > Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated > > unexpectedly with status code -1073740972. The system will now shut down and > > restart. > > > > > > "Michael Easterly" wrote: > > > > > Source: LSASRV > > > Castegory: SPNEGO (Negotiator) > > > Event ID: 40968 > > > > > > The Security System has received an authentication request that could not be > > > decoded. The request has failed. > > > > > > I can't find a reference for this Warning anywhere, please help. > > > > > >
From: Tariq Azad on 15 Mar 2006 12:05
Michael- I am just curious if ot is possible for you to reboot the system, and then send me the Application and system log file for further analysis? Thanks, Tariq "Tariq Azad" <tariq_bin_azad(a)hotmail.com> wrote in message news:XridnVr7xu1I2oXZnZ2dnUVZ_sydnZ2d(a)giganews.com... Michael- Thanks for a prompt reply. I didn't get answers of my other questions. Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... Regards, Tariq "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:862C950F-6654-4870-BE2D-DEA5703E7670(a)microsoft.com... I checked out the articles that you included with your last posting. The first article does not apply becuase the server is not logging events 1015 or 1000 as the article indicates. The second article doesn't apply either. Whereas SP1 includes 835732, (http://www.microsoft.com/technet/security/prodtech/windowsserver2003/sp1..mspx) I ran the baseline security analyser to see what hotfixes are installed and below are the results (Scanned with MBSA version: 2.0.5029.2): MS05-036 Security Update for Windows Server 2003 (KB901214) MS05-039 Security Update for Windows Server 2003 (KB899588) MS05-040 Security Update for Windows Server 2003 (KB893756) MS05-033 Security Update for Windows Server 2003 (KB896428) MS05-027 Security Update for Windows Server 2003 (KB896422) MS05-026 Security Update for Windows Server 2003 (KB896358) MS05-042 Security Update for Windows Server 2003 (KB899587) MS05-032 Security Update for Windows Server 2003 (KB890046) MS05-041 Security Update for Windows Server 2003 (KB899591) MS05-045 Security Update for Windows Server 2003 (KB905414) MS05-051 Security Update for Windows Server 2003 (KB902400) MS05-046 Security Update for Windows Server 2003 (KB899589) MS05-048 Security Update for Windows Server 2003 (KB901017) MS05-049 Security Update for Windows Server 2003 (KB900725) MS05-053 Security Update for Windows Server 2003 (KB896424) MS05-050 Security Update for Windows Server 2003 (KB904706) MS05-054 Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB905915) MS06-001 Security Update for Windows Server 2003 (KB912919) MS06-002 Security Update for Windows Server 2003 (KB908519) MS06-008 Security Update for Windows Server 2003 (KB911927) MS06-009 Security Update for Windows Server 2003 (KB901190) MS06-006 Security Update for Windows Media Player Plug-in (KB911564) MS06-007 Security Update for Windows Server 2003 (KB913446) 890830 Windows Malicious Software Removal Tool - March 2006 (KB890830) Thanks in advance for your assistance. "Tariq Azad" wrote: > Michael- > > Are there other events like event 6033 or 50? Do you have any other event even related with time syncronization? Is this a first DC in the domain? If this is a second / additional domain controller, then I would suggest you to build a new one, install OS, basic patches, Virus scan, (no service pack), and then see the results... > > I know that LSASRV has some known issues. Please check the following link to see if it applies in your case. > http://support.microsoft.com/default.aspx?scid=kb;en-us;818080 > http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx > > Regards, > > Tariq Azad > "Michael Easterly" <MichaelEasterly(a)discussions.microsoft.com> wrote in message news:839A2818-305F-404F-A62D-4D101E6368F5(a)microsoft.com... > Tariq: > > I know that you didn't ask me for this information, but I'm going to post it > anyway. > > Microsoft Windows 2003 SP1 (5.2.3790) > > All current updates/hotfixes are installed onto the server. This server is > configured for DC, DNS, DHCP, File/Print. With a default installation, no > tweaks have been applied to this server at this time whereas it is a fresh > install. > > Thanks in advance for your help! > > "Tariq Azad" wrote: > > > George- > > > > Thanks for posting your message here. > > Is it a warning or an error? Please provide some more information including: > > OS Version > > Server Pack Version > > > > Regards, > > > > Tariq Azad > > > > "George" <George(a)discussions.microsoft.com> wrote in message news:0A6F3483-DE66-4D20-886E-D8224EB37954(a)microsoft.com... > > I am having same problem followed by the following restart. > > > > The process winlogon.exe has initiated the restart of computer FS1 on behalf > > of user for the following reason: No title for this reason could be found > > > > Reason Code: 0x50006 > > > > Shutdown Type: restart > > > > Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated > > unexpectedly with status code -1073740972. The system will now shut down and > > restart. > > > > > > "Michael Easterly" wrote: > > > > > Source: LSASRV > > > Castegory: SPNEGO (Negotiator) > > > Event ID: 40968 > > > > > > The Security System has received an authentication request that could not be > > > decoded. The request has failed. > > > > > > I can't find a reference for this Warning anywhere, please help. > > > > > > |