From: Drew Boillot on
Hello, I have a few PCs that are in use after hours that they seem to just,
lock up at 5:45 like clock work.

On all 3 of the PCs, i get errors like the following,


-----Start Error(s)
The Security System detected an attempted downgrade attack for server
cifs/ntserver. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon
request.

(0xc000005e)".

-------------------------------------

The Security System could not establish a secured connection with the server
cifs/ntserver. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

The browser was unable to retrieve a list of servers from the browser master
\\NTSERVER on the network
\Device\NetBT_Tcpip_{204C8C41-4DF3-4CD4-A0A3-70AE3CC277B2}. The data is the
error code.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

The Security System detected an attempted downgrade attack for server
cifs/DEDE. The failure code from authentication protocol Kerberos was "There
are currently no logon servers available to service the logon request.

(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

The Security System could not establish a secured connection with the server
cifs/DEDE. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----End Error(s)

now, ntserver is our 2003 Standard server w/ TS installed and running, the
"server" Dede is a winXP Pro PC. I'm not sure what is going on, but i see
these errors at the time the PCs get sluggish then locks up.

can anyone tell me what to do.. or at least where to start looking?


From: Raoul on
If they consistantly lock up at the same time, the first thing I would look
at is the task scheduler to see if anything is scheduled to run at that time
of day.

"Drew Boillot" <drew(a)gocmcs.com> wrote in message
news:OiE1TqcFFHA.208(a)TK2MSFTNGP12.phx.gbl...
Hello, I have a few PCs that are in use after hours that they seem to just,
lock up at 5:45 like clock work.

On all 3 of the PCs, i get errors like the following,


-----Start Error(s)
The Security System detected an attempted downgrade attack for server
cifs/ntserver. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon
request.

(0xc000005e)".

-------------------------------------

The Security System could not establish a secured connection with the server
cifs/ntserver. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

The browser was unable to retrieve a list of servers from the browser master
\\NTSERVER on the network
\Device\NetBT_Tcpip_{204C8C41-4DF3-4CD4-A0A3-70AE3CC277B2}. The data is the
error code.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

The Security System detected an attempted downgrade attack for server
cifs/DEDE. The failure code from authentication protocol Kerberos was "There
are currently no logon servers available to service the logon request.

(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

The Security System could not establish a secured connection with the server
cifs/DEDE. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----End Error(s)

now, ntserver is our 2003 Standard server w/ TS installed and running, the
"server" Dede is a winXP Pro PC. I'm not sure what is going on, but i see
these errors at the time the PCs get sluggish then locks up.

can anyone tell me what to do.. or at least where to start looking?



From: Karl on
Try this webpage:
http://www.eventid.net/display.asp?eventid=40960&eventno=787&source=LsaSrv&phase=1

or this info form Microsoft
http://support.microsoft.com/kb/139410/EN-US/

"Drew Boillot" <drew(a)gocmcs.com> wrote in message
news:OiE1TqcFFHA.208(a)TK2MSFTNGP12.phx.gbl...
> Hello, I have a few PCs that are in use after hours that they seem to
just,
> lock up at 5:45 like clock work.
>
> On all 3 of the PCs, i get errors like the following,
>
>
> -----Start Error(s)
> The Security System detected an attempted downgrade attack for server
> cifs/ntserver. The failure code from authentication protocol Kerberos was
> "There are currently no logon servers available to service the logon
> request.
>
> (0xc000005e)".
>
> -------------------------------------
>
> The Security System could not establish a secured connection with the
server
> cifs/ntserver. No authentication protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ----------------------------------------
>
> The browser was unable to retrieve a list of servers from the browser
master
> \\NTSERVER on the network
> \Device\NetBT_Tcpip_{204C8C41-4DF3-4CD4-A0A3-70AE3CC277B2}. The data is
the
> error code.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ------------------------------------------
>
> The Security System detected an attempted downgrade attack for server
> cifs/DEDE. The failure code from authentication protocol Kerberos was
"There
> are currently no logon servers available to service the logon request.
>
> (0xc000005e)".
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----------------------------------------
>
> The Security System could not establish a secured connection with the
server
> cifs/DEDE. No authentication protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----End Error(s)
>
> now, ntserver is our 2003 Standard server w/ TS installed and running, the
> "server" Dede is a winXP Pro PC. I'm not sure what is going on, but i see
> these errors at the time the PCs get sluggish then locks up.
>
> can anyone tell me what to do.. or at least where to start looking?
>
>


From: Drew Boillot on
This is the first thing I tried. I even changed the antivirus scan times.
I will try the things suggested in the next post Monday.

Thanks

"Raoul" <noname(a)noname.net> wrote in message
news:h%nRd.78$873.73(a)newsread3.news.pas.earthlink.net...
> If they consistantly lock up at the same time, the first thing I would
> look
> at is the task scheduler to see if anything is scheduled to run at that
> time
> of day.
>
> "Drew Boillot" <drew(a)gocmcs.com> wrote in message
> news:OiE1TqcFFHA.208(a)TK2MSFTNGP12.phx.gbl...
> Hello, I have a few PCs that are in use after hours that they seem to
> just,
> lock up at 5:45 like clock work.
>
> On all 3 of the PCs, i get errors like the following,
>
>
> -----Start Error(s)
> The Security System detected an attempted downgrade attack for server
> cifs/ntserver. The failure code from authentication protocol Kerberos was
> "There are currently no logon servers available to service the logon
> request.
>
> (0xc000005e)".
>
> -------------------------------------
>
> The Security System could not establish a secured connection with the
> server
> cifs/ntserver. No authentication protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ----------------------------------------
>
> The browser was unable to retrieve a list of servers from the browser
> master
> \\NTSERVER on the network
> \Device\NetBT_Tcpip_{204C8C41-4DF3-4CD4-A0A3-70AE3CC277B2}. The data is
> the
> error code.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ------------------------------------------
>
> The Security System detected an attempted downgrade attack for server
> cifs/DEDE. The failure code from authentication protocol Kerberos was
> "There
> are currently no logon servers available to service the logon request.
>
> (0xc000005e)".
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----------------------------------------
>
> The Security System could not establish a secured connection with the
> server
> cifs/DEDE. No authentication protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----End Error(s)
>
> now, ntserver is our 2003 Standard server w/ TS installed and running, the
> "server" Dede is a winXP Pro PC. I'm not sure what is going on, but i see
> these errors at the time the PCs get sluggish then locks up.
>
> can anyone tell me what to do.. or at least where to start looking?
>
>
>