Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Microsoft Exchange Server has detected that NTLM-based authentication is presently being used between this server and server "<server>". NTLM is still a secure authentication mechanism and protects users' credentials. However this indicates that there may be a configuration issue preventing the use of Kerberos authentication. If this condition persists please verify that both this server and server "<server>" are properly configured to use Kerberos authentication. After applying any changes it may be necessary to restart Internet Information Services on both the front-end and back-end servers.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is NTLM authentication?
Whare are the credentials?
What is Kerberos?
What is the role of ESENT?
See ME909094 for a hotfix applicable to Microsoft Exchange Server 2003.
As per Microsoft: "This event may be logged on an Exchange Server 2003 server configured as a front-end server when both of the following conditions are true:
1.An Exchange Server 2003 front-end server is attempting authentication to a back-end server.
2.The back-end server is running Exchange 2000 Server. Exchange 2000 Server does not support Kerberos authentication".
See MSEX2K3DB for additional information about this event.
This error may also occur if you are using Exchange 2003 in a Front-End/Back-End environment and allow basic authentication between the servers. This is a non-issue according to Microsoft unless the Front-end server is in a DMZ. The authentication methods would then need to be changed in the IIS settings on the back-end server to avoid these messages.
I received this warning after installing Sharepoint Portal Server on a 2003 Domain Controller. ME832769 helped me to resolve the problem.
|Private comment: Subscribers only. See example of private comment|
|Links: ME832769, ME909094, MSEX2K3DB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated