The account it is talking about is probably the machine account.... Todd's post has a lot of good info. Some other things that could cause this is the possibility of lots of network dropout losing Kerberos UDP packets or something like a Cisco CSM discarding kerberos fragmented packets.
joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barber, Thomas Sent: Tuesday, October 07, 2003 12:47 PM To: [EMAIL PROTECTED] We have been experiencing some issues with several client computers. Most of the time the issues revolve around users not being able to log in, with the message coming back as "Account has been disabled." This seems to happen more on Windows XP Pro than Windows 2000. Our environment: Native mode AD Windows 2000 Servers, no windows 2003 servers. When we take a client off of the domain, then add them back on they work for a variable amount of time, then go right back to the same message. I am getting System event messages as follows: Category: SPNEGO (Negotiator) Event ID: 40960 Description: The Security System detected an attempted downgrade attack for server DOMAIN\DC1$. The failure code from authentication protocol Kerberos was "The referenced account is currently disabled and may not be logged on to. (0xc0000072)". The accounts I am using to log in with are NOT disabled. I have verified this time and again. After researching on the net, I have heard that some of the issue may be FRS. Also, I have not seen these machines pull down new group policy in the last day or two. Has any had this issue? Any thoughts on how to resolve? Not all client machines have the problem...just some of them. Also, the above messages are usually listed three to five in a row, with each message going to a different domain controller. Any help would be greatly appreciated. Thanks. -Tom .+w ������Y P ������ .+-j! 0j! or yﶜ���I㚊V+v* List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
