we deinstall the may out-of-band patch and solved the probleme with audit log.
logon, find application
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 95%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Chris
656
Reputation points
hello all,
does anybody know an tool that help us to find logons?
why have an audit tool that shows tausend bad logons.
Username ClientIP ClientHOstName DC etc.
host 127.0.0.1 AD2.firma.de AD2.firma.de Di, Jun 7, 2022 11:20 Failure Bad user name Details A Kerberos authentication ticket (TGT) was requested for host from AD2.firma.de Status : Failure. . Error : Bad user name
We don't have a User "host".
How can we find the service, or application.
additional info: we found that the problem is since install windows10.0-kb5015018-x64_e790c270e6078a9a21bb2e0615c14e353a8b71ba out-of-band AD update
Windows for business | Windows Server | User experience | Other
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 89%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
TheAppGuru 1 Reputation point2022-07-16T12:38:03.64+00:00 We are seeing this after installing the June 2022 updates which included the May OOB update. Uninstalling the update does resolve the errors in the log.
It’s occurring on some Domain Controllers and Exchange Servers. We are seeing random password prompts with Outlook, I’m thinking it may be related, but we also installed CU23 for Exchange 2016 and the May security update.
I took a packet capture and viewed the Kerberos packets with the account name host. There are two SNameStrings in the packet, one contains “host” and one contains a server name. Comparing this to other KRB packets usually it contains the username and domain.
I’m wondering if there’s an undocumented change in these updates or a some bug was introduced.
Sign in to comment
2 answers
Sort by: Most helpful
-
Chris 656 Reputation points
2022-06-07T15:32:41.687+00:00 -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2022-06-07T12:52:32.62+00:00 What audit tool are you asking about? May need to engage the application developer.