Results 1 to 4 of 4

Thread: LsaSrv 40960

  1. #1
    Join Date
    Feb 2006

    LsaSrv 40960

    The below error messages are appearing in the DC logs since the user changed this password. I think that something has retained his old password and it trying to access Group Policies every 2 hours. What is it that is trying to do this and how do I persuade it to use the new password? It occurs when the user has logged off the network and shut their workstation down. This error only happens when the user is not logged on the network:

    Event Type: Warning
    Event Source: LSASRV
    Event Category: SPNEGO (Negotiator)
    Event ID: 40960
    Date: 22/01/2007
    Time: 06:57:53
    User: N/A
    Computer: SENIOR
    The Security System detected an authentication error for the server ldap/senior.sion_domain.local/sion_domain.local@sion_domain.local. The failure code from authentication protocol Kerberos was "The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)".

    Application Event Log - every 2 hours (approx)

    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1030
    Date: 22/01/2007
    Time: 08:45:54
    User: SION_DOMAIN\username
    Computer: SENIOR
    Description: Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

  2. #2
    Join Date
    Jan 2006

    RE: LsaSrv 40960

    Even I have seen these 40961 and 40960 errors many times, and after putting a lot of time looking into them, and I was not able to find a cause.

  3. #3
    Join Date
    Jan 2006
    Can you try to go to the computer senior and open up the services, from control panel, and see if you can find any services that have an account that is invalid also and go to the scheduled tasks on senior and look for the same thing.

  4. #4
    Join Date
    Jan 2006
    Thanks for the help, I have finally solves this issue actually. The server just crashed out of a sudden due to Raid failure and when I restarted and rebuilt, then this error was not showing any more.

Similar Threads

  1. Event ID : 40960 LSAsrv / SPNego
    By Iraiyavan in forum Active Directory
    Replies: 3
    Last Post: 19-11-2009, 03:04 PM
  2. Event ID 40960 LSASRV SPNEGO
    By SB in forum Windows Server Help
    Replies: 1
    Last Post: 01-03-2007, 03:01 PM
  3. LSASRV; Event ID: 40968
    By Michael Easterly in forum Windows Server Help
    Replies: 12
    Last Post: 16-03-2006, 12:54 AM
  4. LsaSrv Event ID 40960 and 40961
    By G-Man in forum Windows Security
    Replies: 2
    Last Post: 15-02-2005, 03:55 AM
  5. LSASRV Event ID: 40961
    By =?Utf-8?B?TWlrZSBCbGFrZQ==?= in forum Windows Server Help
    Replies: 6
    Last Post: 22-01-2005, 08:25 PM

Tags for this Thread


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
Page generated in 1,695,468,037.43531 seconds with 17 queries