October 7, 2009 at 9:31 am
I have been unable to find this on any other forum so I posting here in hopes someone can tell me if this event is a concern. It is happening on 2 servers. Sql 2008 Service pack 1 has not been applied.
Event Type:Failure Audit
Event Source:Security
Event Category:Account Logon
Event ID:673
Date:10/7/2009
Time:6:20:00 AM
User:NT AUTHORITY\SYSTEM
Computer:servername
Description:
Service Ticket Request:
User Name:svcSQLServer@www.ourdomain.com
User Domain:http://www.ourdomain.com
Service Name:svcSQLServer@www.ourdomain.com
Service ID:-
Ticket Options:0x40810000
Ticket Encryption Type:-
Client Address:127.0.0.1
Failure Code:0x1B
Logon GUID:-
Transited Services:-
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
October 7, 2009 at 6:35 pm
The 0x1B indicates that the server principal is valid for user-to-user only. The thing that stands out to me is the service name. I'm not sure why it's the same as the user. Have you verified your SPNs are correct? I'm stretching here, because I can't find much on it, either.
K. Brian Kelley
@kbriankelley
Viewing 2 posts - 1 through 1 (of 1 total)
You must be logged in to reply to this topic. Login to reply