Event ID: 40960



tjatkinson
07-09-2005, 11:53 PM
Hi All,

I am getting the following event logged on my 2003 member server randomly
throughout the day. EventID: 40960 generally refers to an attempted downgrade
attack event on an XPSP2 machine. Can anyone tell me what this means?

Source: LSASRV
Category: SPNEGO (Negotiator)
Event ID: 40960
Description:
The Security System detected an authentication error for the server
ldap/server.acmecorp.com/acmecorp.com@acmecorp.com. The failure code from
authentication protocol Kerberos was "The referenced account is currently
disabled and may not be logged on to. (0xc0000072)".

Roger Abell
07-09-2005, 11:53 PM
You have a reason to not believe the referenced cause
"The referenced account is currently disabled
and may not be logged on to. (0xc0000072)".
??

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"tjatkinson" <tjatkinson@discussions.microsoft.com> wrote in message
news:D0D0D21D-F873-4808-8D53-B1475BED0AE7@microsoft.com...
> Hi All,
>
> I am getting the following event logged on my 2003 member server randomly
> throughout the day. EventID: 40960 generally refers to an attempted
downgrade
> attack event on an XPSP2 machine. Can anyone tell me what this means?
>
> Source: LSASRV
> Category: SPNEGO (Negotiator)
> Event ID: 40960
> Description:
> The Security System detected an authentication error for the server
> ldap/server.acmecorp.com/acmecorp.com@acmecorp.com. The failure code from
> authentication protocol Kerberos was "The referenced account is currently
> disabled and may not be logged on to. (0xc0000072)".


Event ID: 40960