LsaSrv Event ID 40960 and 40961

I've had it with this error. Any ideas? It's happening to all of my Windows
XP Pro SP2 workstations in connection with a Windows 2000 Server.

The Security System could not establish a secured connection with the server
cifs/SERVER. No authentication protocol was available.

The Security System detected an attempted downgrade attack for server
cifs/SERVER. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon request.
(0xc000005e)".

I've tried everything Microsoft has listed in the support section and
everything I could find on multiple webpages. This is not only happening in
my office. I have several clients that I deal with on a daily basis that are
having the same problem with the same setup in their office. They have to
reboot their workstations about every 24 hour period to make them work again.
It can happen when trying to print to a network server or just trying to
access a network drive. This is really starting to tick me off.

Is Microsoft Security Bulletin MS04-011 installed on both computers?

If so, try this?
http://support.microsoft.com/kb/841617

If not, what other what other "Microsoft has listed in the support section"
fixes have you tried? I don't repeat your resolution attempts.

"G-Man" wrote:

> I've had it with this error. Any ideas? It's happening to all of my Windows
> XP Pro SP2 workstations in connection with a Windows 2000 Server.
>
> The Security System could not establish a secured connection with the server
> cifs/SERVER. No authentication protocol was available.
>
> The Security System detected an attempted downgrade attack for server
> cifs/SERVER. The failure code from authentication protocol Kerberos was
> "There are currently no logon servers available to service the logon request.
> (0xc000005e)".
>
> I've tried everything Microsoft has listed in the support section and
> everything I could find on multiple webpages. This is not only happening in
> my office. I have several clients that I deal with on a daily basis that are
> having the same problem with the same setup in their office. They have to
> reboot their workstations about every 24 hour period to make them work again.
> It can happen when trying to print to a network server or just trying to
> access a network drive. This is really starting to tick me off.

I haven't manually installed that update so unless it's rolled out
automatically through the Windows Update, the answer is no.

This is what I've tried so far:
823712 - I disabled the time service to test this
I also created a reverse lookup zone in the DNS because some people said
they solved their problem this way. No long term success for me.
Keep in mind this isn't happening on the server. The server logs for the
same time period show nothing. It's only happening on the workstations. And
it doesn't happen every day. It does, however, force a user to lose anything
network related they were working on so this is a serious issue.

There were a few other tricks that I tested (can't remember them all) with
no luck. And now it happened yesterday to a friend of mine that has a Windows
2003 SBE Server and all Windows XP Pro SP2 workstations. Two of their
workstations had it happen as well. So this isn't just an isolated incident.


"Phil Agcaoili" wrote:

> Is Microsoft Security Bulletin MS04-011 installed on both computers?
>
> If so, try this?
> http://support.microsoft.com/kb/841617
>
> If not, what other what other "Microsoft has listed in the support section"
> fixes have you tried? I don't repeat your resolution attempts.
>
> "G-Man" wrote:
>
> > I've had it with this error. Any ideas? It's happening to all of my Windows
> > XP Pro SP2 workstations in connection with a Windows 2000 Server.
> >
> > The Security System could not establish a secured connection with the server
> > cifs/SERVER. No authentication protocol was available.
> >
> > The Security System detected an attempted downgrade attack for server
> > cifs/SERVER. The failure code from authentication protocol Kerberos was
> > "There are currently no logon servers available to service the logon request.
> > (0xc000005e)".
> >
> > I've tried everything Microsoft has listed in the support section and
> > everything I could find on multiple webpages. This is not only happening in
> > my office. I have several clients that I deal with on a daily basis that are
> > having the same problem with the same setup in their office. They have to
> > reboot their workstations about every 24 hour period to make them work again.
> > It can happen when trying to print to a network server or just trying to
> > access a network drive. This is really starting to tick me off.