none
Kerberos error Events

    Question

  • We keep seeing hundreds of events for the following event  - 

    event id 675 type 0x2 failure code 0x18 EventType=16 service name krbtgt

    Say, a user agrees to have entered bad password twice, but entered the correct one the third time around. why does those 2 bad logins create hundred's of events instead of 2 ? with event id 675 type 0x2 failure code 0x18  ?

    Monday, January 23, 2017 9:37 PM

Answers

  • Hi,

    You can refer to the following link to get more information:

    Discovering the Cause of an Event ID 675


    Please don't forget to mark the correct answer, to help others who have the same issue. Thameur BOURBITA MCSE | MCSA My Blog : http://bourbitathameur.blogspot.fr/

    • Marked as answer by Kulsou87 Tuesday, January 24, 2017 4:29 PM
    Monday, January 23, 2017 11:39 PM
  • Hi,
    For support Windows infrastructure features like Active Directory, Group Policy, Dynamic DNS updates and more, workstations, servers and domain controllers must frequently communicate with each other.
    Please check if the same event is still logged after the correct password is entered.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Kulsou87 Tuesday, January 24, 2017 4:29 PM
    Tuesday, January 24, 2017 9:50 AM
    Moderator

All replies

  • Hi,

    You can refer to the following link to get more information:

    Discovering the Cause of an Event ID 675


    Please don't forget to mark the correct answer, to help others who have the same issue. Thameur BOURBITA MCSE | MCSA My Blog : http://bourbitathameur.blogspot.fr/

    • Marked as answer by Kulsou87 Tuesday, January 24, 2017 4:29 PM
    Monday, January 23, 2017 11:39 PM
  • Hello,

    Thank you for the info. However, the article does mention a few scenarios but i am still not able to understand that how can 2 bad "attempts" cause so many logs? is it possible?


    Tuesday, January 24, 2017 12:00 AM
  • Hi,
    For support Windows infrastructure features like Active Directory, Group Policy, Dynamic DNS updates and more, workstations, servers and domain controllers must frequently communicate with each other.
    Please check if the same event is still logged after the correct password is entered.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Kulsou87 Tuesday, January 24, 2017 4:29 PM
    Tuesday, January 24, 2017 9:50 AM
    Moderator