Results 1 to 4 of 4

Thread: Event ID 40960 + 40961 / SPNEGO

  1. #1
    Join Date
    Jan 2006
    Posts
    104

    Event ID 40960 + 40961 / SPNEGO

    I am using Windows XP with SP2 and latest updates installed in an AD Domain, dc is a Windows Server 2003. The problem is that the user account has been automatically locked and am getting the below in the event ids:


    Event ID: 40690
    Type: Warning
    Usre: N/A
    Source: LSASRV
    Category: SPNEGO (Negotiator)

    Description:
    The Security System detected an attempted downgrade attack for server cifs/SERVERNAME.DOMAINNAME.net. The failure code from authentication protocol Kerberos was "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. (0xc0000234)".

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Event ID: 40691
    Type: Warning
    Usre: N/A
    Source: LSASRV
    Category: SPNEGO (Negotiator)

    Description: The Security System could not establish a secured connection with the server cifs/SERVERNAME.DOMAINNAME.net. No authentication protocol was available.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

  2. #2
    Join Date
    Sep 2005
    Posts
    1,476

    Re: Event ID 40960 + 40961 / SPNEGO

    Check the below articles to solve your issue:

    DNS request for prisoner.iana.org
    http://support.microsoft.com/default...b;en-us;259922

    Event IDs 40960 and 40961 in the System Event Log When You Restart Windows Server 2003 After You Run Dcpromo.exe
    http://support.microsoft.com/default...b;en-us;823712

    LSASRV Event IDs 40960 and 40961 When You Promote a Server to a Domain Controller Role
    http://support.microsoft.com/default...b;en-us;824217

    You cannot access network resources after you try to log on to a Windows XP Service Pack 2-based computer
    http://support.microsoft.com/default...b;en-us;885887

  3. #3
    Join Date
    Jan 2006
    Posts
    104

    Re: Event ID 40960 + 40961 / SPNEGO

    Thanks but the articles that you have listed are not helping me? Do you have any other methods?

  4. #4
    Join Date
    Nov 2005
    Posts
    709
    I think that the most common problem for this issue is given in the below link that points with time synchronization or misconfigured DNS:

    http://www.eventid.net/display.asp?e...LsaSrv&phase=1

Similar Threads

  1. 40960, 40961 System Event errors:
    By Mike Bonvie in forum Active Directory
    Replies: 3
    Last Post: 17-12-2009, 12:15 AM
  2. Event ID : 40960 LSAsrv / SPNego
    By Iraiyavan in forum Active Directory
    Replies: 3
    Last Post: 19-11-2009, 03:04 PM
  3. Event ID 40960 LSASRV SPNEGO
    By SB in forum Windows Server Help
    Replies: 1
    Last Post: 01-03-2007, 03:01 PM
  4. Event ID: 40960 SPNEGO (Negotiator) authentication error
    By Mauricio Reyes in forum Windows Security
    Replies: 1
    Last Post: 07-04-2006, 11:47 PM
  5. LsaSrv Event ID 40960 and 40961
    By G-Man in forum Windows Security
    Replies: 2
    Last Post: 15-02-2005, 03:55 AM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,711,693,474.65385 seconds with 17 queries