kerberos error event ID 675 with 0x19 error code


The error event 675 with 0X19 error code indicates:

0x19 - KDC_ERR_PREAUTH_REQUIRED: Additional pre-authentication required

In domain environment, Kerberos is the default authentication protocol. In
Kerberos Authentication protocol implemented in Windows, Pre-authentication
is required by default. However, sometimes, clients may not include the
pre-authentication data in first communication with KDC (the AS_REQ). As a
result, KDC returns an error to inform client that Pre-Authentication
is required, and then an event ID 675 with the error 0x19 is recorded on
KDC.


Meanwhile, please set the flag "Do not require pre-authentication" for the
problematic account EXC$, to configure the system to not require
pre-authentication. For user accounts, we can enable this flag in User
Properties. For computer account, we should modify the attribute
UserAccountControl via the following steps:

1. On the domain controller, click Start, click Run, type in "adsiedit.msc"
(without the quotation marks) and press ENTER to launch ADSI Edit tool.
This tool is included with the Windows 2003 Support Tools. To install the
Support Tools, run Suptools.msi from the Support\Tools folder on the
Windows 2003 Server CD-ROM.
2. Locate the computer accounts DOMAIN\EXC$ under the Domain partition.
3. Right-click on "DOMAIN\EXC$", click Properties.
4. Then locate the attribute "UserAccountControl" in the Attributes list.
Click Edit.
5. Modify the value to original value plus 4194304. For example, if the
original value is 512, the new value should be 512+4194304=4194816
6. Click OK, click Apply, and click OK.
7. Quit ADSI Edit. Then you can check if the event 675 stops for these
accounts.

For more information about UserAccountControl attribute, you can refer to
the following article:

How to use the UserAccountControl flags to manipulate user account
properties


http://support.microsoft.com/kb/305144

Security Log Events That Might Contain Kerberos Error Codes

Event ID Account Logon Event Type Event Information Potentially Associated with Kerberos Authentication

672

Success audit (Windows 2000 and Windows Server 2003)

Failure audit (Windows Server 2003)

Authentication Ticket Request:

User Name

Supplied Realm Name

User ID

Service Name

Service ID

Ticket Options

Result Code: Kerberos error code

Ticket Encryption Type

Pre-Authentication Type

Client Address

Certificate Issuer Name

Certificate Serial Number

Certificate Thumbprint

 

673

Success audit (Windows 2000 and Windows Server 2003)

Failure audit (Windows Server 2003)

Service Ticket Request:

User Name

User Domain

Service Name

Service ID

Ticket Options

Ticket Encryption Type

Client Address

Failure Code: Kerberos Error Code

Logon GUID

Transited Services

 

675

Failure audit

Pre-authentication Failed:

User Name

User ID

Service Name

Pre-authentication Type

Failure Code: Kerberos error code

Client Address

 

676

Failure audit (Obsolete in Windows Server 2003; both success and failure audits use event ID 672.)

Authentication Ticket Request Failed:

User Name

Supplied Realm Name

Service Name

Ticket Options

Failure Code: Kerberos error code

Client Address

 

677

Failure audit (Obsolete in Windows Server 2003; both success and failure audits use event ID 673.)

Service Ticket Request Failed:

User Name

User Domain

Service Name

Ticket Options

Failure Code: Kerberos error code

Client Address

 

Kerberos V5 Authentication Protocol Error Messages Generated by Windows Server 2003

Kerberos Error Number Kerberos Error Code Description

0x3

KDC_ERR_BAD_PVNO

Requested protocol version number not supported.

0x6

KDC_ERR_C_PRINCIPAL_UNKNOWN

Client not found in Kerberos database.

0x7

KDC_ERR_S_PRINCIPAL_UNKNOWN

Server not found in Kerberos database.

0x8

KDC_ERR_PRINCIPAL_NOT_UNIQUE

Multiple principal entries in database.

0xA

KDC_ERR_CANNOT_POSTDATE

Ticket not eligible for postdating.

0xB

KDC_ERR_NEVER_VALID

Requested start time is later than end time.

0xC

KDC_ERR_POLICY

KDC policy rejects request.

0xD

KDC_ERR_BADOPTION

KDC cannot accommodate requested option.

0xE

KDC_ERR_ETYPE_NOSUPP

KDC has no support for encryption type.

0xF

KDC_ERR_SUMTYPE_NOSUPP

KDC has no support for checksum type.

0x10

KDC_ERR_PADATA_TYPE_NOSUPP

KDC has no support for pre-authentication data type.

0x12

KDC_ERR_CLIENT_REVOKED

Client€™s credentials have been revoked.

0x17

KDC_ERR_KEY_EXPIRED

Password has expired - change password to reset.

0x18

KDC_ERR_PREAUTH_FAILED

Pre-authentication information was invalid.

0x19

KDC_ERR_PREAUTH_REQUIRED

Additional pre-authentication required.

0x1B

KDC_ERR_MUST_USE_USER2USER

Server principal valid for user-to-user only.

0x1C

KDC_ERR_PATH_NOT_ACCPETED

KDC Policy rejects transited path.

0x1D

KDC_ERR_SVC_UNAVAILABLE

A service is not available.

0x1F

KRB_AP_ERR_BAD_INTEGRITY

Integrity check on decrypted field failed.

0x20

KRB_AP_ERR_TKT_EXPIRED

Ticket expired.

0x21

KRB_AP_ERR_TKT_NYV

Ticket not yet valid.

0x22

KRB_AP_ERR_REPEAT

Request is a replay.

0x23

KRB_AP_ERR_NOT_US

The ticket isn€™t for us.

0x24

KRB_AP_ERR_BADMATCH

Ticket and authenticator do not match.

0x25

KRB_AP_ERR_SKEW

Clock skew too great.

0x28

KRB_AP_ERR_MSG_TYPE

Invalid message type.

0x29

KRB_AP_ERR_MODIFIED

Message stream modified.

0x34

KRB_ERR_RESPONSE_TOO_BIG

Response too big for UDP, retry with TCP.

0x3C

KRB_ERR_GENERIC

Generic error (description in e-text).

0x44

KDC_ERR_WRONG_REALM

User-to-user TGT issued different KDC.