Windows event id 4 (kerberos)

[Christopher D. Clausen]

Is this for an actual Windows computer?  Or a non-Windows machine 
running something like Samba?

-----

I see these all the time.  I believe these occur on occation when a 
computer account automatically updates its machine account password in 
Active Directory.  (This is a normal function of a computer joined to 
AD.)

I'd suggest un-joining and re-joining the computer to the domain if this 
is a persistent problem on this system.

If the issue persists you likely have a network connection problem. 
Check netstat -s output and look for high error counts and check duplex 
settings on all ends of the connection.

-----

Another thing to check is for identially named accounts (as mentioned,) 
including SPNs that were set with setspn.exe or ktpass.exe.  These are 
hard to track down and may require specific LDAP queries to locate.

-----

Please send output of setspn -l SLH-001155

<<CDC

raj esh L <rrcrajesh2003 at yahoo.com> wrote:
> We have observed Kerberos event id4 on one member server (Print
> server )BRAPRINT001 (10.1.37.167). Please find the description below
> about the event id. Can some one please help me on it ?
>
> Event Type:            Error
> Event Source:          Kerberos
> Event Category:      None
> Event ID:                4
> Date:                       1/13/2010
> Time:                       6:16:35 PM
> User:                       N/A
> Computer:               BRAPRINT001
> Description:
> The kerberos client received a KRB_AP_ERR_MODIFIED error from the
> server SLH-001155$.  The target name used was
> cifs/ATL017784.dir.ucb-group.com. This indicates that the password
> used to encrypt the kerberos service ticket is different than that on
> the target server. Commonly, this is due to identically named
> machine accounts in the target realm (DIR.UCB-GROUP.COM), and the
> client realm.   Please contact your system administrator.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> ATL017784.dir.ucb-group.com [10.70.11.107]
>
> We captured network for it. Can you please help here what is going on?
>
>
> captured file is available at http://www.megaupload.com/?d=WDIG1CAT
>
>
>
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos