Event ID: 7 Source: KDC

Discussion:

(too old to reply)

Keshav

2007-03-06 10:41:09 UTC

Hi All,

I see this event in one our servers.

"The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was ACCOUNTNAME$@DOMAIN.INTRA
and lookup type 0x28."

"The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was ACCOUNTNAME$ and lookup type
0x8."

Any ideas to troubleshoot this?

I googled and found an article related to this but for Windows 2000.

Any help would be really appreciated.

Thanks,

Keshav

Nick Domukhovsky

2007-03-06 11:41:53 UTC

Permalink

Post by Keshav
Hi All,
I see this event in one our servers.
"The Security Account Manager failed a KDC request in an unexpected way. The
and lookup type 0x28."
"The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was ACCOUNTNAME$ and lookup type
0x8."
Any ideas to troubleshoot this?
I googled and found an article related to this but for Windows 2000.
Any help would be really appreciated.
Thanks,
Keshav

1. What is in the data field?
2. Is your clock in sync?

--
With best regards
Nickolay Domukhovsky, MCSA

Keshav

2007-03-06 13:24:02 UTC

Permalink

Thanks for the reply.

What I posted is the exact error message displayed under "Description" of
the event. I couldn't find anything more on the "data field".

Clock is in Sync.

Post by Nick Domukhovsky

1. What is in the data field?
2. Is your clock in sync?
--
With best regards
Nickolay Domukhovsky, MCSA

Paul Bergson [MVP-DS]

2007-03-06 13:52:02 UTC

Permalink

Have you reviewed the KB article 812499?

http://support.microsoft.com/kb/812499/en-us
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Keshav
Thanks for the reply.
What I posted is the exact error message displayed under "Description" of
the event. I couldn't find anything more on the "data field".
Clock is in Sync.

Post by Nick Domukhovsky

Post by Keshav
Hi All,
I see this event in one our servers.
"The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was
and lookup type 0x28."
"The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was ACCOUNTNAME$ and lookup type
0x8."
Any ideas to troubleshoot this?
I googled and found an article related to this but for Windows 2000.
Any help would be really appreciated.
Thanks,
Keshav

1. What is in the data field?
2. Is your clock in sync?
--
With best regards
Nickolay Domukhovsky, MCSA

Keshav

2007-03-06 15:21:03 UTC

Permalink

But is this for Windows Server 2003 as well?

Post by Paul Bergson [MVP-DS]
Have you reviewed the KB article 812499?
http://support.microsoft.com/kb/812499/en-us
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Keshav
Thanks for the reply.
What I posted is the exact error message displayed under "Description" of
the event. I couldn't find anything more on the "data field".
Clock is in Sync.

Post by Nick Domukhovsky

1. What is in the data field?
2. Is your clock in sync?
--
With best regards
Nickolay Domukhovsky, MCSA

Paul Bergson [MVP-DS]

2007-03-06 16:10:48 UTC

Permalink

No I thought you were explaining you were on 2000 but I must have misread,
sounds like you are on 2003. Are there any other error messages in the
Event logs? Service Principal Name errors?
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Keshav
But is this for Windows Server 2003 as well?

Post by Keshav
Thanks for the reply.
What I posted is the exact error message displayed under "Description" of
the event. I couldn't find anything more on the "data field".
Clock is in Sync.

Post by Nick Domukhovsky

1. What is in the data field?
2. Is your clock in sync?
--
With best regards
Nickolay Domukhovsky, MCSA

m***@gmail.com

2007-04-05 05:17:04 UTC

Permalink

On Mar 7, 2:10 am, "Paul Bergson [MVP-DS]"

Post by Paul Bergson [MVP-DS]
No I thought you were explaining you were on 2000 but I must have misread,
sounds like you are on 2003. Are there any other error messages in the
Event logs? Service Principal Name errors?
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Keshav
But is this for Windows Server 2003 as well?

Post by Keshav
Thanks for the reply.
What I posted is the exact error message displayed under "Description" of
the event. I couldn't find anything more on the "data field".
Clock is in Sync.

Post by Nick Domukhovsky

Post by Keshav
Hi All,
I see this event in one our servers.
"The Security Account Manager failed a KDC request in an unexpected
way. The
error is in the data field. The account name was
and lookup type 0x28."
"The Security Account Manager failed a KDC request in an unexpected
way. The
error is in the data field. The account name was ACCOUNTNAME$ and
lookup type
0x8."
Any ideas to troubleshoot this?
I googled and found an article related to this but for Windows 2000.
Any help would be really appreciated.
Thanks,
Keshav

1. What is in the data field?
2. Is your clock in sync?
--
With best regards
Nickolay Domukhovsky, MCSA

Any more ideas on how to rid a server of these error messages?

I get them on one of our servers also.

It is running Windows Server 2003 Standard Edition SP2

Paul Bergson [MVP-DS]

2007-04-05 12:43:59 UTC

Permalink

I wonder if this DC needs to have its machine account password reset?

http://support.microsoft.com/kb/325850
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by m***@gmail.com
On Mar 7, 2:10 am, "Paul Bergson [MVP-DS]"

Post by Keshav
But is this for Windows Server 2003 as well?

Post by Keshav
Thanks for the reply.
What I posted is the exact error message displayed under
"Description"
of
the event. I couldn't find anything more on the "data field".
Clock is in Sync.

Post by Nick Domukhovsky

Post by Keshav
Hi All,
I see this event in one our servers.
"The Security Account Manager failed a KDC request in an unexpected
way. The
error is in the data field. The account name was
and lookup type 0x28."
"The Security Account Manager failed a KDC request in an unexpected
way. The
error is in the data field. The account name was ACCOUNTNAME$ and
lookup type
0x8."
Any ideas to troubleshoot this?
I googled and found an article related to this but for Windows 2000.
Any help would be really appreciated.
Thanks,
Keshav

1. What is in the data field?
2. Is your clock in sync?
--
With best regards
Nickolay Domukhovsky, MCSA

Any more ideas on how to rid a server of these error messages?
I get them on one of our servers also.
It is running Windows Server 2003 Standard Edition SP2

Dan

2007-05-27 03:13:00 UTC

Permalink

Has anyone had an good answer for this? I have this error on a windows 2003
DC as well. I posted this in this forum then found this post.

Any help would be great

Environment:
Domain functional level: Windows 2000 mixed
Forest functional level: Windows 2000
Number of domain controllers: 4 (3-2003 and 1-2000)

I rebooted the DC that holds all fsmo roles and upon reboot see at most 4
entries in its system log like the ones below. This is only happening on a
reboot of this server. I can open and edit all GPO's (only 3) in the domain.

The computers/user accounts listed changes with every reboot.

MFRAME20A = Computer Account
dswinfor = User Account

***********************************************
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 5/26/2007
Time: 10:43:07 AM
User: N/A
Computer: APOLLO
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was MFRAME20A$@domain.COM and
lookup type 0x28.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 17 00 00 c0 ...À

***********************************************

Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 5/26/2007
Time: 10:43:07 AM
User: N/A
Computer: APOLLO
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was MFRAME20A$ and lookup type
0x8.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 17 00 00 c0 ...À

***********************************************

Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 5/26/2007
Time: 10:43:07 AM
User: N/A
Computer: APOLLO
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was ***@domain and lookup
type 0x20.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 17 00 00 c0 ...À

***********************************************

Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 5/26/2007
Time: 10:43:07 AM
User: N/A
Computer: APOLLO
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was dswinfor and lookup type 0x0.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 17 00 00 c0 ...À

***********************************************

Ace Fekay [MVP]

2007-05-27 05:03:14 UTC

Permalink

Post by Dan
Has anyone had an good answer for this? I have this error on a
windows 2003 DC as well. I posted this in this forum then found this
post.
Any help would be great

<snipped>

Does the scenario in the following article apply to y our scenario?

http://support.microsoft.com/?id=812499

If not, please post the following configuration information to provide
better you with better assistance:

1. ipconfig /all from a client and from your DC(s)
2. The DNS domain name of AD (found in ADUC)
3. The zonename in your Forward Lookup Zones in DNS
4. If updates are set to allow under zone properties
5. If this machine has more than one NIC
6. Do you have a firewall? If so, what brand?
7. Is/are forwarder(s) configured?
8. Do the SRV records exist under your zone name?
9. How many subnets or locations? Sites created for each location?
10. DHCP Client Service (not the DHCP Server Service) disabled?
11. Clock times different on the DCs or any other machines in the domain
(taking into consideration time zone difference)?
--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations

Having difficulty reading or finding responses to your post?
Instead of the website you're using, try using OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. Anonymous access. It's free - no username or password
required nor do you need a Newsgroup Usenet account with your ISP. It
connects directly to the Microsoft Public Newsgroups. OEx allows you
o easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject. It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

"Quitting smoking is easy. I've done it a thousand times." - Mark Twain