Event-o-Pedia EventID 676 - Authentication Ticket Request Failed [Win 2000]

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Account Logon->EventID 676 - Authentication Ticket Request Failed [Win 2000]

EventID 676 - Authentication Ticket Request Failed [Win 2000]

This event is not generated by Windows Server 2003 with SP1.This event is logged when the user/computer initial logon fails for other reasons than those reported by EventID 675 - Pre-authentication failed.

Some fields provide codes as values. Refer to the following links in order to see human-readable descriptions:

Failure Code

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2003
Note: This event is not logged on Windows 2003, instead a failed instance of event 672 is logged.

EventID 672 - Authentication Ticket Request [Win 2003]

Windows 2008

EventID 4768 - A Kerberos authentication ticket (TGT) was requested

Related events:

Windows 2000

EventID 675 - Pre-Authentication Failed

Sample:

        Event Type:     Failure Audit
        Event Source:   Security
        Event Category: Account Logon
        Event ID:       676
        Date:           11/13/2009
        Time:           11:33:21
        User:           NT AUTHORITY\SYSTEM
        Computer:       DCCC1
        Description:
        Authentication Ticket Request Failed:
        User Name:	Paul
        Supplied Realm Name:	LOGISTICS
        Service Name:	krbtgt/LOGISTICS
        Ticket Options:	0x40810010
        Failure Code:	0x12
        Client Address:	127.0.0.1

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2000
Category	Account Logon
Source	Security
EventId	676

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Category	A name for a subclass of events within the same Event Source.	Category	Logon/Logoff
User Name	Account name of the user/computer requesting the ticket	InsertionString1	Paul
Supplied Realm Name	User/computer account's DNS suffix	InsertionString2	LOGISTICS
Service Name	The account name of the service distributing tickets, e.g. krbtgt	InsertionString3	krbtgt/LOGISTICS
Ticket Options	A hexadecimal number representing the Key Distribution Center (KDC) Option flags that were used or requested when the ticket was issued. KDC Option flags include information such as whether a ticket can be forwarded or renewed. The number in the Ticket Options field is a bit mask.	InsertionString4	0x40810010
Failure Code	Displays the reason for the authentication failure. Please find the code descriptions here.	InsertionString5	0x12
Client Address	IP address of the workstation from which the authentication ticket request was sent.	InsertionString6	127.0.0.1