Click here to get back home

Unable to resolve SPNEGO Event ID 40961 errors
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Unable to resolve SPNEGO Event ID 40961 errors Leythos 11-25-2007
Posted by Leythos on November 25, 2007, 12:54 pm
Please log in for more thread options
 I have a few workstations, not all of them, that randomly start getting
security failures in their event logs, rebooting the main server and the
workstations often takes care of it, but not always. I've looked all
over the net, tried many things, but I can't seem to shake this.

Anyone have a solution path for getting rid of these errors?

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 11/25/2007
Time: 11:49:23 AM
User: N/A
Computer: WS56
Description:
The Security System could not establish a secured connection with the
server
ldap/servername.domainname.local/domainname.local@domainname.local.
No authentication protocol was available


--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Posted by Joe D on November 25, 2007, 1:27 pm
Please log in for more thread options
 is there something "wrong"? or are you just thinking something is wrong
because you see these events?



>I have a few workstations, not all of them, that randomly start getting
> security failures in their event logs, rebooting the main server and the
> workstations often takes care of it, but not always. I've looked all
> over the net, tried many things, but I can't seem to shake this.
>
> Anyone have a solution path for getting rid of these errors?
>
> Event Type: Warning
> Event Source: LSASRV
> Event Category: SPNEGO (Negotiator)
> Event ID: 40961
> Date: 11/25/2007
> Time: 11:49:23 AM
> User: N/A
> Computer: WS56
> Description:
> The Security System could not establish a secured connection with the
> server
> ldap/servername.domainname.local/domainname.local@domainname.local.
> No authentication protocol was available
>
>
> --
>
> Leythos
> - Igitur qui desiderat pacem, praeparet bellum.
> - Calling an illegal alien an "undocumented worker" is like calling a
> drug dealer an "unlicensed pharmacist"
> spam999free@rrohio.com (remove 999 for proper email address)


Posted by Leythos on November 25, 2007, 2:28 pm
Please log in for more thread options
> is there something "wrong"? or are you just thinking something is wrong
> because you see these events?

I'm assuming that since I get an Authentication Error in the security
event log, that there should be something wrong.

Any user that logs onto the problem machine will cause a Security Event
entry showing logon authentication failure, but they can login without
any problem.

I don't see this in any of the other domains we manage, just this one
and only on some workstations.

The SPNEGRO error is common for the ones that fail, if I disjoin from
the domain, delete the computer account, and rejoin it, it goes away 90%
of the time and doesn't return - but once in a while I have a computer
that doesn't seem to resolve that problem.


--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Posted by Meinolf Weber on November 25, 2007, 4:52 pm
Please log in for more thread options
Hello Leythos,

Did you have a reverse lookup zone created in DNS console? If not create
it, should help you.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm

>
>> is there something "wrong"? or are you just thinking something is
>> wrong because you see these events?
>>
> I'm assuming that since I get an Authentication Error in the security
> event log, that there should be something wrong.
>
> Any user that logs onto the problem machine will cause a Security
> Event entry showing logon authentication failure, but they can login
> without any problem.
>
> I don't see this in any of the other domains we manage, just this one
> and only on some workstations.
>
> The SPNEGRO error is common for the ones that fail, if I disjoin from
> the domain, delete the computer account, and rejoin it, it goes away
> 90% of the time and doesn't return - but once in a while I have a
> computer that doesn't seem to resolve that problem.
>



Posted by Leythos on November 25, 2007, 5:12 pm
Please log in for more thread options
> Hello Leythos,
>
> Did you have a reverse lookup zone created in DNS console? If not create
> it, should help you.

Yes, for all 6 subnets (we have a few branch offices that register their
DNS, but the ones (workstations) that cause the problem are the local
subnet ones.

What if I remove the records in the reverse LUZ?


--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Similar ThreadsPosted
W2K3 Member Server unable to resolve domain SIDs October 12, 2006, 11:56 am
Event ID: 40960 SPNEGO (Negotiator) authentication error April 7, 2006, 3:22 am
event log errors January 27, 2006, 3:08 pm
continuing errors in event viewr June 2, 2006, 12:35 am
Multiple Event ID 529 Errors in Server 2003 April 10, 2006, 1:34 pm
Administrator account disabled but still get "incorrect password" errors in Event log May 4, 2008, 2:11 pm
Administrator account disabled but still get "incorrect password" errors in Event log May 4, 2008, 2:12 pm
Event ID 2003 Unable to open the performance logs and alerts confi May 30, 2006, 6:28 am
SPNEGO without a domain February 21, 2006, 4:21 pm
SPNEGO / SSPI / SSO / GSSAPI Questions September 12, 2006, 11:11 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap