Event submitted by Anonymous
Event ID:
672
Source:
Security
Category:
Account Logon

Message:
Authentication Ticket Request:
User Name: computer$
Supplied Realm Name: DOMAIN.LOCAL
User ID: -
Service Name: krbtgt/DOMAIN.LOCAL
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: 192.168.1.122
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:




System32 Reference




Solution by Anonymous

2007-01-02 17:37:31 UTC

This Audit Failure started appearing when a domain machine was renamed but not rebooted yet. The "Result Code: 0x6" means "The username doesn't exist"


Solution by Event Log Doctor

2009-03-17 11:16:25 UTC

We got this audit failure from a user that was logged on to a terminal server with a disconnected session.

The user account was renamed while the user was technically still logged on to the terminal server, which resulted in the domain controller issuing the 672 audit failure.

"Client Address" pointed to the terminal server in this case.

This event was accompanied by a 40960 warning event in the system log from the terminal server.


Solution by Event Log Doctor

2012-02-21 22:35:44 UTC

Result Code: 0x12 means "Clients credentials have been revoked", usually the result of a disabled or removed user account.



User Information
 
Only an Email address is required for returning users.

Hide Name

Solution

Additional Links