On your Web site (http://www.ultimatewindowssecurity.com), your Security Log Encyclopedia description of event ID 673 with failure code 0x20 states that this event indicates an expired ticket and is frequently logged by computer accounts. I have a network of 90 machines, and I've received this failure code more than 27,000 times in two months. Is it normal to log this many expired tickets?
Actually it is. Kerberos tickets do expire, and servers cause most such events because they remain up for weeks and months at a time. To confirm that your numbers were normal, I compared them to the ticket expirations on a customer's network. That network is about a quarter the size of yours, and after quadrupling the number of ticket expirations logged on my customer's domain controllers (DCs) over roughly two months, I came up with 28,620. It's not practical to manually analyze the Windows Security log, and you don't have to treat each event in the log as an actionable item—there's lots of noise in the Security log that you must filter out. I think you can safely assume your failed event ID 673s are such noise.
Register
