none
Getting Kerberos error in system events and id : 3...... See below details of error event RRS feed

  • Question

  • Event Type: Error
    Event Source: Kerberos
    Event Category: None
    Event ID: 3
    Date:  11/17/2011
    Time:  9:52:47 AM
    User:  N/A
    Computer: MDC
    Description:
    A Kerberos Error Message was received:
             on logon session
     Client Time:
     Server Time: 4:22:47.0000 11/17/2011 Z
     Error Code: 0xd KDC_ERR_BADOPTION
     Extended Error: 0xc00000bb KLIN(0)
     Client Realm:
     Client Name:
     Server Realm: SIROCLINPHARM.COM
     Server Name: host/mdc.siroclinpharm.com
     Target Name: host/mdc.siroclinpharm.com@SIROCLINPHARM.COM
     Error Text:
     File: 9
     Line: b22
     Error Data is in record data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 30 15 a1 03 02 01 03 a2   0.¡....¢
    0008: 0e 04 0c bb 00 00 c0 00   ...»..À.
    0010: 00 00 00 03 00 00 00      .......

    Thursday, November 17, 2011 4:33 AM

Answers

  • Hello,

    Have you enabled Kerberos logging, then you should disable it:
    http://support.microsoft.com/kb/262177

    Please go to "0xd KDC_ERR_BADOPTION" in:
    http://www.microsoft.com/downloads/details.aspx?FamilyID=7dfeb015-6043-47db-8238-dc7af89c93f1&displaylang=en

    Regards,
    Sandesh Dubey.
    -------------------------------
    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator
    My Blog: http://sandeshdubey.wordpress.com
    This posting is provided AS IS with no warranties, and confers no rights.

    Thursday, November 17, 2011 4:37 AM
  • Hi,

    Kerberos Event logging: The operating system by default does not create event log entries for Kerberos authentication events. You can however turn this feature by reviewing the following KB article:

    262177 How to enable Kerberos event logging - http://support.microsoft.com/default.aspx?scid=kb;EN-US;262177

    You would enable this feature on the client machines and any other machines participating in Kerberos delegation.

    Note: I would caution you on enabling this feature. There are some events that you will see that are really not Kerberos errors – such as 0x12 KDC_ERR_CLIENT_REVOKED, 0xD KDC_ERR_BADOPTION, or 0x34 KRB_ERR_RESPONSE_TOO_BIG. We have had cases where the customer enabled this from a previous case and never turned it back off. Since they were now sensitive to all Kerberos errors they have opened up a new case just to be asked to turn off the logging because the events were not really errors.

     


    If you found this post helpful, please give it a "Helpful" vote. If it answered your question, remember to mark it as an "Answer". This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
    Thursday, November 17, 2011 6:14 AM

All replies

  • Hello,

    Have you enabled Kerberos logging, then you should disable it:
    http://support.microsoft.com/kb/262177

    Please go to "0xd KDC_ERR_BADOPTION" in:
    http://www.microsoft.com/downloads/details.aspx?FamilyID=7dfeb015-6043-47db-8238-dc7af89c93f1&displaylang=en

    Regards,
    Sandesh Dubey.
    -------------------------------
    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator
    My Blog: http://sandeshdubey.wordpress.com
    This posting is provided AS IS with no warranties, and confers no rights.

    Thursday, November 17, 2011 4:37 AM
  • Thanks.

     

    I have disabled kerberos audit log from registery  and will observe the same...

    W'll update you on this..

    Thursday, November 17, 2011 4:56 AM
  • Hi,

    Kerberos Event logging: The operating system by default does not create event log entries for Kerberos authentication events. You can however turn this feature by reviewing the following KB article:

    262177 How to enable Kerberos event logging - http://support.microsoft.com/default.aspx?scid=kb;EN-US;262177

    You would enable this feature on the client machines and any other machines participating in Kerberos delegation.

    Note: I would caution you on enabling this feature. There are some events that you will see that are really not Kerberos errors – such as 0x12 KDC_ERR_CLIENT_REVOKED, 0xD KDC_ERR_BADOPTION, or 0x34 KRB_ERR_RESPONSE_TOO_BIG. We have had cases where the customer enabled this from a previous case and never turned it back off. Since they were now sensitive to all Kerberos errors they have opened up a new case just to be asked to turn off the logging because the events were not really errors.

     


    If you found this post helpful, please give it a "Helpful" vote. If it answered your question, remember to mark it as an "Answer". This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
    Thursday, November 17, 2011 6:14 AM
  • Hi Thanks

     

    Its fine now. No events are generating now.

    Thursday, November 17, 2011 7:20 AM