Vinnie Cardona vinniecardona at ernesthealth.com
Wed Feb 16 15:10:10 EST 2005



  I don't know if you already resolved this but here what I did:

Server1 = my local server

Server2 = server causing the eventid 3


1.	server1 was receiving Eventid3: 


A Kerberos Error Message was received:

on logon session 

Client Time: 

Server Time: 19:40:41.0000 2/16/2005 Z


 Extended Error: 0xc00000bb KLIN(0)

 Client Realm: 

 Client Name: 

 Server Realm: my.domain.com

 Server Name: host/server1.my.domain.com

 Target Name: host/server1.my.domain.com at my.domain.com

 Error Text: 

 File: 9

 Line: ab8

 Error Data is in record data.

For more information, see Help and Support Center at


My resolution:

a.	Ran netmon and captured packets.  Filtered for the Kerberos
protocol.  Saw that server2 was causing this.  This server was recently
removed and readded to the domain.  There is also an eventid 5722 which
shows which computer may be causing the EventID3 so that you won't have to
run netmon.
b.	Logged onto server2 and ran kerbtray from "Run" (Start-->RUN).
Right clicked on the newly created icon in the system tray and selected
"purge tickets".  As a test I attached to the resources of server1 from
server2 then went back to server1's system log and found that it no longer
generated the eventid3.

HTH (Hope This Helps.)


Take care,



More information about the Kerberos mailing list