Security Log getting spammed with Event 675

Giganews Newsgroups
Subject: Security Log getting spammed with Event 675
Posted by:  Jim A. (Ji…@discussions.microsoft.com)
Date: Wed, 14 Jan 2009

The security log is filling up on my DC with 675 events (pre-authentication
failed). These events are happening over a hundred times a day and I cant
figure out what is causing them.  What is interesting is that the service
name on these events is not the same service name that shows up when I try to
log on to my workstation and intentionally put in a bad password.

First, here are the events that are getting spammed:

Pre-authentication failed:
Username: Administrator
User ID: API\Administrator
Service Name: krbtgt/ADVANCEDPRODUCTSINTL.LOCAL
Pre-authenticaion Type: 0x2
Failure Code: 0x18
Client Address: 192.168.1.240

Now when I try to logon to my workstation and put in a bad pw on purpose,
here’s the event it generates:

Pre-authentication failed:
Username: jsparco
User ID: API\jsparco
Service Name: krbtgt/API
Pre-authenticaion Type: 0x2
Failure Code: 0x18
Client Address: 192.168.1.55

Notice the difference in the service name.  Can anyone help me out?

Replies