上一篇
下一篇
Event ID 11 in the System log of domain controller
作者:Richard 日期:2009-04-16
The following events may be recorded in the System log on one or more domain controllers:
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 11
Date: 4/1/2002
Time: 1:40:14 PM
User: N/A
Computer: ComputerName
Description: There are multiple accounts with name host/mycomputer.mydomain.com of type 10.
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 11
Date: 8/17/2004
Time: 1:30:00 PM
User: N/A
Computer: ComputerName
Description: There are multiple accounts with name HOST/machinename of type DS_SERVICE_PRINCIPAL_NAME.
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 4
Date: 8/17/2004
Time: 1:30:00 PM
User: N/A
Computer: ComputerName
Description: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/machinename.childdomain.rootdomain.com. The target name used was cifs/machinename.domain.com. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (childdomain.rootdomain.COM), and the client realm. Please contact your system administrator.
This event may also apply to other service principal names. For example, this event may also apply to host/NetBIOSComputerName.
Back to the top
CAUSEThis problem occurs because two or more computer accounts have the same service...This problem occurs because two or more computer accounts have the same service principal name (SPN) registered. Event ID 11 is logged when the Key Distribution Center (KDC) receives a ticket request, and the related SPN exists more than one time when it is checked on the global catalog (GC) for forestwide verification.
Back to the top
RESOLUTIONTo resolve this problem, locate the computer accounts that have the duplicate SP...To resolve this problem, locate the computer accounts that have the duplicate SPNs. When you have located the computers that have the duplicate SPNs, you can either delete the computer account from the domain, disjoin and rejoin the computer to the domain, or you can use ADSIEdit to correct the SPN on the computer that has the incorrect SPN.
To locate the computer accounts that have the duplicate SPNs, use one of the following methods.
Back to the top
Method 1: Use the LDP support tool
Note If you do not have the Windows 2000 support tools installed, install them from the Windows 2000 CD-ROM before you continue. The Setup executable file for the support tools is located on the CD-ROM in the Support\Tools folder. The installation does not require that you restart the computer. However, you may have to restart the computer to update the environment variables.
Click Start, click Run, type LDP, and then click OK.
Click Connection, and then click Connect.
Leave the default settings, and then click OK.
Note If you do not receive the expected result, try another search by using the Global Catalog Port (3268) instead of the default setting (389).
Click Connection, and then click Bind.
Leave the default settings, and then click OK.
Click View, and then click Tree.
In the Tree View dialog box, type DC=YourDomain,DC=com in the BaseDN box, where YourDomain is your domain.
Click Browse, and then click Search.
In the Search dialog box, type DC=YourDomain,DC=com in the BaseDN box.
In the Search dialog box, type (serviceprincipalname=HOST/mycomputer.mydomain.com) in the Filter box. If the service principal name that is referred to in the error in the System log differs from this example, type the service principal name to which the error refers.
Note If you do not receive the expected result, try searching for " HOST/" as opposed to searching only for the exact SPN in the event ID.
Under Scope, click Subtree.
Click Run.
Back to the top
Method 2: Use the Ldifde utility
Use the Ldifde utility to dump the SPN for the forest:
From the domain controller, open a command prompt, and then type the following string:
ldifde -f check_SPN.txt -t 3268 -d "" -l servicePrincipalName -r "(servicePrincipalName=HOST/mycomputer*)" -p subtree
(Note Because you use the -t 3268 parameter to specify that a global catalog (GC) server is used in the query, and you do not use the -d parameter to specify an explicit distinguished name (DN), the forest root DN is used with the HOST/mycomputer* parameter. Therefore, you can look for all SPNs that contains this string.
Open the check_SPN.txt file in Notepad, and then search for the SPN that is reported in the event log.
Note the user accounts and the computer accounts under which the SPN is located.
Back to the top
Method 3:
Use the querySpn.vbs script in the following Microsoft TechNet article. To use the script, copy the code, paste it into Notepad, and then save the script as querySpn.vbs.
http://www.microsoft.com/technet/scriptcenter/solutions/spnquery.mspx (http://www.microsoft.com/technet/scriptcenter/solutions/spnquery.mspx)
Run the script by using the following command:
cscript spnquery.vbs HOST/mycomputer* >check_SPN.txt
Note The obtained output file check_SPN.txt from the script in Method 3 can be used the same way as described in Method 2.
Back to the top
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that ar...Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top
--------------------------------------------------------------------------------
APPLIES TO
Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows 2000 Server SP2, when used with:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Back to the top
Keywords: kbenv kberrmsg kbprb KB321044
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 11
Date: 4/1/2002
Time: 1:40:14 PM
User: N/A
Computer: ComputerName
Description: There are multiple accounts with name host/mycomputer.mydomain.com of type 10.
Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 11
Date: 8/17/2004
Time: 1:30:00 PM
User: N/A
Computer: ComputerName
Description: There are multiple accounts with name HOST/machinename of type DS_SERVICE_PRINCIPAL_NAME.
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 4
Date: 8/17/2004
Time: 1:30:00 PM
User: N/A
Computer: ComputerName
Description: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/machinename.childdomain.rootdomain.com. The target name used was cifs/machinename.domain.com. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (childdomain.rootdomain.COM), and the client realm. Please contact your system administrator.
This event may also apply to other service principal names. For example, this event may also apply to host/NetBIOSComputerName.
Back to the top
CAUSEThis problem occurs because two or more computer accounts have the same service...This problem occurs because two or more computer accounts have the same service principal name (SPN) registered. Event ID 11 is logged when the Key Distribution Center (KDC) receives a ticket request, and the related SPN exists more than one time when it is checked on the global catalog (GC) for forestwide verification.
Back to the top
RESOLUTIONTo resolve this problem, locate the computer accounts that have the duplicate SP...To resolve this problem, locate the computer accounts that have the duplicate SPNs. When you have located the computers that have the duplicate SPNs, you can either delete the computer account from the domain, disjoin and rejoin the computer to the domain, or you can use ADSIEdit to correct the SPN on the computer that has the incorrect SPN.
To locate the computer accounts that have the duplicate SPNs, use one of the following methods.
Back to the top
Method 1: Use the LDP support tool
Note If you do not have the Windows 2000 support tools installed, install them from the Windows 2000 CD-ROM before you continue. The Setup executable file for the support tools is located on the CD-ROM in the Support\Tools folder. The installation does not require that you restart the computer. However, you may have to restart the computer to update the environment variables.
Click Start, click Run, type LDP, and then click OK.
Click Connection, and then click Connect.
Leave the default settings, and then click OK.
Note If you do not receive the expected result, try another search by using the Global Catalog Port (3268) instead of the default setting (389).
Click Connection, and then click Bind.
Leave the default settings, and then click OK.
Click View, and then click Tree.
In the Tree View dialog box, type DC=YourDomain,DC=com in the BaseDN box, where YourDomain is your domain.
Click Browse, and then click Search.
In the Search dialog box, type DC=YourDomain,DC=com in the BaseDN box.
In the Search dialog box, type (serviceprincipalname=HOST/mycomputer.mydomain.com) in the Filter box. If the service principal name that is referred to in the error in the System log differs from this example, type the service principal name to which the error refers.
Note If you do not receive the expected result, try searching for " HOST/" as opposed to searching only for the exact SPN in the event ID.
Under Scope, click Subtree.
Click Run.
Back to the top
Method 2: Use the Ldifde utility
Use the Ldifde utility to dump the SPN for the forest:
From the domain controller, open a command prompt, and then type the following string:
ldifde -f check_SPN.txt -t 3268 -d "" -l servicePrincipalName -r "(servicePrincipalName=HOST/mycomputer*)" -p subtree
(Note Because you use the -t 3268 parameter to specify that a global catalog (GC) server is used in the query, and you do not use the -d parameter to specify an explicit distinguished name (DN), the forest root DN is used with the HOST/mycomputer* parameter. Therefore, you can look for all SPNs that contains this string.
Open the check_SPN.txt file in Notepad, and then search for the SPN that is reported in the event log.
Note the user accounts and the computer accounts under which the SPN is located.
Back to the top
Method 3:
Use the querySpn.vbs script in the following Microsoft TechNet article. To use the script, copy the code, paste it into Notepad, and then save the script as querySpn.vbs.
http://www.microsoft.com/technet/scriptcenter/solutions/spnquery.mspx (http://www.microsoft.com/technet/scriptcenter/solutions/spnquery.mspx)
Run the script by using the following command:
cscript spnquery.vbs HOST/mycomputer* >check_SPN.txt
Note The obtained output file check_SPN.txt from the script in Method 3 can be used the same way as described in Method 2.
Back to the top
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that ar...Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top
--------------------------------------------------------------------------------
APPLIES TO
Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows 2000 Server SP2, when used with:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Back to the top
Keywords: kbenv kberrmsg kbprb KB321044
文章来自: 
引用通告: 
Tags: 评论: 0 | 引用: 0 | 查看次数: -
发表评论