I'm running a SBS 2003 Premium server and just recently began getting this
message in the event log.

"The Security System detected an authentication error for the server
cifs/ls-sbs.ls.local. The failure code from authentication protocol Kerberos
was "The attempted logon is invalid. This is either due to a bad username or
authentication information.
(0xc000006d)".

I ran dcdiag and netdiag on the server and everything passed the tests. It
seems to happen around every two hours or so. Things appear to be working ok.
No reported problems but I'm wondering if this is something I should be
concerned about.
Any idea what is causing this and what to do about it. Thanks for your help.

Re: Event ID 40960 by Larry

Larry
Wed Aug 13 09:14:27 PDT 2008

Hi Dave:

Please look over this info and let us know if any applies to you.

http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1

-Larry


"Dave" <Dave@discussions.microsoft.com> wrote in message
news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
> I'm running a SBS 2003 Premium server and just recently began getting this
> message in the event log.
>
> "The Security System detected an authentication error for the server
> cifs/ls-sbs.ls.local. The failure code from authentication protocol
> Kerberos
> was "The attempted logon is invalid. This is either due to a bad username
> or
> authentication information.
> (0xc000006d)".
>
> I ran dcdiag and netdiag on the server and everything passed the tests.
> It
> seems to happen around every two hours or so. Things appear to be working
> ok.
> No reported problems but I'm wondering if this is something I should be
> concerned about.
> Any idea what is causing this and what to do about it. Thanks for your
> help.
>


Re: Event ID 40960 by Dave

Dave
Wed Aug 13 09:44:05 PDT 2008

Thanks for the response but it doesn't seem to apply to our error. Ours is
referring to cifs/server name.

"Larry Struckmeyer [SBS-MVP]" wrote:

> Hi Dave:
>
> Please look over this info and let us know if any applies to you.
>
> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
>
> -Larry
>
>
> "Dave" <Dave@discussions.microsoft.com> wrote in message
> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
> > I'm running a SBS 2003 Premium server and just recently began getting this
> > message in the event log.
> >
> > "The Security System detected an authentication error for the server
> > cifs/ls-sbs.ls.local. The failure code from authentication protocol
> > Kerberos
> > was "The attempted logon is invalid. This is either due to a bad username
> > or
> > authentication information.
> > (0xc000006d)".
> >
> > I ran dcdiag and netdiag on the server and everything passed the tests.
> > It
> > seems to happen around every two hours or so. Things appear to be working
> > ok.
> > No reported problems but I'm wondering if this is something I should be
> > concerned about.
> > Any idea what is causing this and what to do about it. Thanks for your
> > help.
> >
>
>

Re: Event ID 40960 by Larry

Larry
Wed Aug 13 11:40:12 PDT 2008

One link I found suggested that DNS might contribute to this. Please verify
that all your SBS nics point ONLY to the internal nic of the SBS ip address
for DNS, and that the isp DNS addresses are in your DNS forwarders tabs.

-Larry

"Dave" <Dave@discussions.microsoft.com> wrote in message
news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
> Thanks for the response but it doesn't seem to apply to our error. Ours is
> referring to cifs/server name.
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
>> Hi Dave:
>>
>> Please look over this info and let us know if any applies to you.
>>
>> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
>>
>> -Larry
>>
>>
>> "Dave" <Dave@discussions.microsoft.com> wrote in message
>> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
>> > I'm running a SBS 2003 Premium server and just recently began getting
>> > this
>> > message in the event log.
>> >
>> > "The Security System detected an authentication error for the server
>> > cifs/ls-sbs.ls.local. The failure code from authentication protocol
>> > Kerberos
>> > was "The attempted logon is invalid. This is either due to a bad
>> > username
>> > or
>> > authentication information.
>> > (0xc000006d)".
>> >
>> > I ran dcdiag and netdiag on the server and everything passed the tests.
>> > It
>> > seems to happen around every two hours or so. Things appear to be
>> > working
>> > ok.
>> > No reported problems but I'm wondering if this is something I should be
>> > concerned about.
>> > Any idea what is causing this and what to do about it. Thanks for your
>> > help.
>> >
>>
>>


Re: Event ID 40960 by Dave

Dave
Wed Aug 13 12:02:07 PDT 2008

Yes, that is how it is setup.

"Larry Struckmeyer [SBS-MVP]" wrote:

> One link I found suggested that DNS might contribute to this. Please verify
> that all your SBS nics point ONLY to the internal nic of the SBS ip address
> for DNS, and that the isp DNS addresses are in your DNS forwarders tabs.
>
> -Larry
>
> "Dave" <Dave@discussions.microsoft.com> wrote in message
> news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
> > Thanks for the response but it doesn't seem to apply to our error. Ours is
> > referring to cifs/server name.
> >
> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >
> >> Hi Dave:
> >>
> >> Please look over this info and let us know if any applies to you.
> >>
> >> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
> >>
> >> -Larry
> >>
> >>
> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> >> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
> >> > I'm running a SBS 2003 Premium server and just recently began getting
> >> > this
> >> > message in the event log.
> >> >
> >> > "The Security System detected an authentication error for the server
> >> > cifs/ls-sbs.ls.local. The failure code from authentication protocol
> >> > Kerberos
> >> > was "The attempted logon is invalid. This is either due to a bad
> >> > username
> >> > or
> >> > authentication information.
> >> > (0xc000006d)".
> >> >
> >> > I ran dcdiag and netdiag on the server and everything passed the tests.
> >> > It
> >> > seems to happen around every two hours or so. Things appear to be
> >> > working
> >> > ok.
> >> > No reported problems but I'm wondering if this is something I should be
> >> > concerned about.
> >> > Any idea what is causing this and what to do about it. Thanks for your
> >> > help.
> >> >
> >>
> >>
>
>

Re: Event ID 40960 by Larry

Larry
Wed Aug 13 12:27:57 PDT 2008

Have you run the SBS Best Practices Analyzer?

www.sbsbpa.com

-Larry

"Dave" <Dave@discussions.microsoft.com> wrote in message
news:4F4AA8F1-3DC6-4EF0-84A1-C6106F8423C3@microsoft.com...
> Yes, that is how it is setup.
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
>> One link I found suggested that DNS might contribute to this. Please
>> verify
>> that all your SBS nics point ONLY to the internal nic of the SBS ip
>> address
>> for DNS, and that the isp DNS addresses are in your DNS forwarders tabs.
>>
>> -Larry
>>
>> "Dave" <Dave@discussions.microsoft.com> wrote in message
>> news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
>> > Thanks for the response but it doesn't seem to apply to our error. Ours
>> > is
>> > referring to cifs/server name.
>> >
>> > "Larry Struckmeyer [SBS-MVP]" wrote:
>> >
>> >> Hi Dave:
>> >>
>> >> Please look over this info and let us know if any applies to you.
>> >>
>> >> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
>> >>
>> >> -Larry
>> >>
>> >>
>> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
>> >> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
>> >> > I'm running a SBS 2003 Premium server and just recently began
>> >> > getting
>> >> > this
>> >> > message in the event log.
>> >> >
>> >> > "The Security System detected an authentication error for the server
>> >> > cifs/ls-sbs.ls.local. The failure code from authentication protocol
>> >> > Kerberos
>> >> > was "The attempted logon is invalid. This is either due to a bad
>> >> > username
>> >> > or
>> >> > authentication information.
>> >> > (0xc000006d)".
>> >> >
>> >> > I ran dcdiag and netdiag on the server and everything passed the
>> >> > tests.
>> >> > It
>> >> > seems to happen around every two hours or so. Things appear to be
>> >> > working
>> >> > ok.
>> >> > No reported problems but I'm wondering if this is something I should
>> >> > be
>> >> > concerned about.
>> >> > Any idea what is causing this and what to do about it. Thanks for
>> >> > your
>> >> > help.
>> >> >
>> >>
>> >>
>>
>>


Re: Event ID 40960 by Dave

Dave
Thu Aug 14 10:45:01 PDT 2008

BPA looks good. No errors.

"Larry Struckmeyer [SBS-MVP]" wrote:

> Have you run the SBS Best Practices Analyzer?
>
> www.sbsbpa.com
>
> -Larry
>
> "Dave" <Dave@discussions.microsoft.com> wrote in message
> news:4F4AA8F1-3DC6-4EF0-84A1-C6106F8423C3@microsoft.com...
> > Yes, that is how it is setup.
> >
> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >
> >> One link I found suggested that DNS might contribute to this. Please
> >> verify
> >> that all your SBS nics point ONLY to the internal nic of the SBS ip
> >> address
> >> for DNS, and that the isp DNS addresses are in your DNS forwarders tabs.
> >>
> >> -Larry
> >>
> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> >> news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
> >> > Thanks for the response but it doesn't seem to apply to our error. Ours
> >> > is
> >> > referring to cifs/server name.
> >> >
> >> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >> >
> >> >> Hi Dave:
> >> >>
> >> >> Please look over this info and let us know if any applies to you.
> >> >>
> >> >> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
> >> >>
> >> >> -Larry
> >> >>
> >> >>
> >> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> >> >> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
> >> >> > I'm running a SBS 2003 Premium server and just recently began
> >> >> > getting
> >> >> > this
> >> >> > message in the event log.
> >> >> >
> >> >> > "The Security System detected an authentication error for the server
> >> >> > cifs/ls-sbs.ls.local. The failure code from authentication protocol
> >> >> > Kerberos
> >> >> > was "The attempted logon is invalid. This is either due to a bad
> >> >> > username
> >> >> > or
> >> >> > authentication information.
> >> >> > (0xc000006d)".
> >> >> >
> >> >> > I ran dcdiag and netdiag on the server and everything passed the
> >> >> > tests.
> >> >> > It
> >> >> > seems to happen around every two hours or so. Things appear to be
> >> >> > working
> >> >> > ok.
> >> >> > No reported problems but I'm wondering if this is something I should
> >> >> > be
> >> >> > concerned about.
> >> >> > Any idea what is causing this and what to do about it. Thanks for
> >> >> > your
> >> >> > help.
> >> >> >
> >> >>
> >> >>
> >>
> >>
>
>

Re: Event ID 40960 by Larry

Larry
Thu Aug 14 18:26:25 PDT 2008

No additional errors? No symptoms?

Was this server installed from scratch into a new domain? Not a migration
or an introduction into an existing AD network?

-Larry


"Dave" <Dave@discussions.microsoft.com> wrote in message
news:F23E95CD-2D67-432A-B7BF-1284A33B692F@microsoft.com...
> BPA looks good. No errors.
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
>> Have you run the SBS Best Practices Analyzer?
>>
>> www.sbsbpa.com
>>
>> -Larry
>>
>> "Dave" <Dave@discussions.microsoft.com> wrote in message
>> news:4F4AA8F1-3DC6-4EF0-84A1-C6106F8423C3@microsoft.com...
>> > Yes, that is how it is setup.
>> >
>> > "Larry Struckmeyer [SBS-MVP]" wrote:
>> >
>> >> One link I found suggested that DNS might contribute to this. Please
>> >> verify
>> >> that all your SBS nics point ONLY to the internal nic of the SBS ip
>> >> address
>> >> for DNS, and that the isp DNS addresses are in your DNS forwarders
>> >> tabs.
>> >>
>> >> -Larry
>> >>
>> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
>> >> news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
>> >> > Thanks for the response but it doesn't seem to apply to our error.
>> >> > Ours
>> >> > is
>> >> > referring to cifs/server name.
>> >> >
>> >> > "Larry Struckmeyer [SBS-MVP]" wrote:
>> >> >
>> >> >> Hi Dave:
>> >> >>
>> >> >> Please look over this info and let us know if any applies to you.
>> >> >>
>> >> >> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
>> >> >>
>> >> >> -Larry
>> >> >>
>> >> >>
>> >> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
>> >> >> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
>> >> >> > I'm running a SBS 2003 Premium server and just recently began
>> >> >> > getting
>> >> >> > this
>> >> >> > message in the event log.
>> >> >> >
>> >> >> > "The Security System detected an authentication error for the
>> >> >> > server
>> >> >> > cifs/ls-sbs.ls.local. The failure code from authentication
>> >> >> > protocol
>> >> >> > Kerberos
>> >> >> > was "The attempted logon is invalid. This is either due to a bad
>> >> >> > username
>> >> >> > or
>> >> >> > authentication information.
>> >> >> > (0xc000006d)".
>> >> >> >
>> >> >> > I ran dcdiag and netdiag on the server and everything passed the
>> >> >> > tests.
>> >> >> > It
>> >> >> > seems to happen around every two hours or so. Things appear to be
>> >> >> > working
>> >> >> > ok.
>> >> >> > No reported problems but I'm wondering if this is something I
>> >> >> > should
>> >> >> > be
>> >> >> > concerned about.
>> >> >> > Any idea what is causing this and what to do about it. Thanks for
>> >> >> > your
>> >> >> > help.
>> >> >> >
>> >> >>
>> >> >>
>> >>
>> >>
>>
>>


Re: Event ID 40960 by Dave

Dave
Fri Aug 15 10:21:05 PDT 2008

I beleive the server was installed from scratch about two years ago. Single
domain, single SBS server. The problem only seems to have started about two
weeks ago. Everything appears to be working fine just getting the message in
the event logs.

"Larry Struckmeyer [SBS-MVP]" wrote:

> No additional errors? No symptoms?
>
> Was this server installed from scratch into a new domain? Not a migration
> or an introduction into an existing AD network?
>
> -Larry
>
>
> "Dave" <Dave@discussions.microsoft.com> wrote in message
> news:F23E95CD-2D67-432A-B7BF-1284A33B692F@microsoft.com...
> > BPA looks good. No errors.
> >
> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >
> >> Have you run the SBS Best Practices Analyzer?
> >>
> >> www.sbsbpa.com
> >>
> >> -Larry
> >>
> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> >> news:4F4AA8F1-3DC6-4EF0-84A1-C6106F8423C3@microsoft.com...
> >> > Yes, that is how it is setup.
> >> >
> >> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >> >
> >> >> One link I found suggested that DNS might contribute to this. Please
> >> >> verify
> >> >> that all your SBS nics point ONLY to the internal nic of the SBS ip
> >> >> address
> >> >> for DNS, and that the isp DNS addresses are in your DNS forwarders
> >> >> tabs.
> >> >>
> >> >> -Larry
> >> >>
> >> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> >> >> news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
> >> >> > Thanks for the response but it doesn't seem to apply to our error.
> >> >> > Ours
> >> >> > is
> >> >> > referring to cifs/server name.
> >> >> >
> >> >> > "Larry Struckmeyer [SBS-MVP]" wrote:
> >> >> >
> >> >> >> Hi Dave:
> >> >> >>
> >> >> >> Please look over this info and let us know if any applies to you.
> >> >> >>
> >> >> >> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
> >> >> >>
> >> >> >> -Larry
> >> >> >>
> >> >> >>
> >> >> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> >> >> >> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
> >> >> >> > I'm running a SBS 2003 Premium server and just recently began
> >> >> >> > getting
> >> >> >> > this
> >> >> >> > message in the event log.
> >> >> >> >
> >> >> >> > "The Security System detected an authentication error for the
> >> >> >> > server
> >> >> >> > cifs/ls-sbs.ls.local. The failure code from authentication
> >> >> >> > protocol
> >> >> >> > Kerberos
> >> >> >> > was "The attempted logon is invalid. This is either due to a bad
> >> >> >> > username
> >> >> >> > or
> >> >> >> > authentication information.
> >> >> >> > (0xc000006d)".
> >> >> >> >
> >> >> >> > I ran dcdiag and netdiag on the server and everything passed the
> >> >> >> > tests.
> >> >> >> > It
> >> >> >> > seems to happen around every two hours or so. Things appear to be
> >> >> >> > working
> >> >> >> > ok.
> >> >> >> > No reported problems but I'm wondering if this is something I
> >> >> >> > should
> >> >> >> > be
> >> >> >> > concerned about.
> >> >> >> > Any idea what is causing this and what to do about it. Thanks for
> >> >> >> > your
> >> >> >> > help.
> >> >> >> >
> >> >> >>
> >> >> >>
> >> >>
> >> >>
> >>
> >>
>
>

Re: Event ID 40960 by Michael

Michael
Tue Aug 26 10:08:04 PDT 2008

Same exact problem here. I have a new deployment that ran fine for its first
2 weeks now it is acting up with the event log error. Any help would be
appreciated.

"Dave" wrote:

> I beleive the server was installed from scratch about two years ago. Single
> domain, single SBS server. The problem only seems to have started about two
> weeks ago. Everything appears to be working fine just getting the message in
> the event logs.
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
> > No additional errors? No symptoms?
> >
> > Was this server installed from scratch into a new domain? Not a migration
> > or an introduction into an existing AD network?
> >
> > -Larry
> >
> >
> > "Dave" <Dave@discussions.microsoft.com> wrote in message
> > news:F23E95CD-2D67-432A-B7BF-1284A33B692F@microsoft.com...
> > > BPA looks good. No errors.
> > >
> > > "Larry Struckmeyer [SBS-MVP]" wrote:
> > >
> > >> Have you run the SBS Best Practices Analyzer?
> > >>
> > >> www.sbsbpa.com
> > >>
> > >> -Larry
> > >>
> > >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> > >> news:4F4AA8F1-3DC6-4EF0-84A1-C6106F8423C3@microsoft.com...
> > >> > Yes, that is how it is setup.
> > >> >
> > >> > "Larry Struckmeyer [SBS-MVP]" wrote:
> > >> >
> > >> >> One link I found suggested that DNS might contribute to this. Please
> > >> >> verify
> > >> >> that all your SBS nics point ONLY to the internal nic of the SBS ip
> > >> >> address
> > >> >> for DNS, and that the isp DNS addresses are in your DNS forwarders
> > >> >> tabs.
> > >> >>
> > >> >> -Larry
> > >> >>
> > >> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> > >> >> news:87A08642-1AFC-4330-BE0B-42CE559A70C6@microsoft.com...
> > >> >> > Thanks for the response but it doesn't seem to apply to our error.
> > >> >> > Ours
> > >> >> > is
> > >> >> > referring to cifs/server name.
> > >> >> >
> > >> >> > "Larry Struckmeyer [SBS-MVP]" wrote:
> > >> >> >
> > >> >> >> Hi Dave:
> > >> >> >>
> > >> >> >> Please look over this info and let us know if any applies to you.
> > >> >> >>
> > >> >> >> http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1
> > >> >> >>
> > >> >> >> -Larry
> > >> >> >>
> > >> >> >>
> > >> >> >> "Dave" <Dave@discussions.microsoft.com> wrote in message
> > >> >> >> news:FAB89DAC-0A79-4E0C-82FF-2C59DA1411B5@microsoft.com...
> > >> >> >> > I'm running a SBS 2003 Premium server and just recently began
> > >> >> >> > getting
> > >> >> >> > this
> > >> >> >> > message in the event log.
> > >> >> >> >
> > >> >> >> > "The Security System detected an authentication error for the
> > >> >> >> > server
> > >> >> >> > cifs/ls-sbs.ls.local. The failure code from authentication
> > >> >> >> > protocol
> > >> >> >> > Kerberos
> > >> >> >> > was "The attempted logon is invalid. This is either due to a bad
> > >> >> >> > username
> > >> >> >> > or
> > >> >> >> > authentication information.
> > >> >> >> > (0xc000006d)".
> > >> >> >> >
> > >> >> >> > I ran dcdiag and netdiag on the server and everything passed the
> > >> >> >> > tests.
> > >> >> >> > It
> > >> >> >> > seems to happen around every two hours or so. Things appear to be
> > >> >> >> > working
> > >> >> >> > ok.
> > >> >> >> > No reported problems but I'm wondering if this is something I
> > >> >> >> > should
> > >> >> >> > be
> > >> >> >> > concerned about.
> > >> >> >> > Any idea what is causing this and what to do about it. Thanks for
> > >> >> >> > your
> > >> >> >> > help.
> > >> >> >> >
> > >> >> >>
> > >> >> >>
> > >> >>
> > >> >>
> > >>
> > >>
> >
> >