none
Getting Event ID: 40960 and 537

    Question

  • I have started getting the following errors in Event log:

    Event Type: Warning
    Event Source: LSASRV
    Event Category: SPNEGO (Negotiator)
    Event ID: 40960
    Date:  7/25/2013
    Time:  11:38:38 AM
    User:  N/A
    Computer: SPELLDC
    Description:
    The Security System detected an authentication error for the server DNS/spelldc.nazareth.local.  The failure code from authentication protocol Kerberos was "A specified logon session does not exist. It may already have been terminated.
    (0xc000005f)".

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 537
    Date:  7/25/2013
    Time:  5:03:24 AM
    User:  NT AUTHORITY\SYSTEM
    Computer: SPELLDC
    Description:
    Logon Failure:
      Reason:  An error occurred during logon
      User Name: 
      Domain:  
      Logon Type: 3
      Logon Process: Kerberos
      Authentication Package: Kerberos
      Workstation Name: -
      Status code: 0xC000005F
      Substatus code: 0x0
      Caller User Name: -
      Caller Domain: -
      Caller Logon ID: -
      Caller Process ID: -
      Transited Services: -
      Source Network Address: 192.168.16.251
      Source Port: 6231

    This is the only DC getting the errors. The only change were some security updates that I installed last week.

    Any idea what would cause these errors to suddenly start? Any help will be greatly appreciated.



    Ivan Becker

    Friday, July 26, 2013 12:14 AM

Answers

All replies