Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Process <process> (PID=<PID>). Received LDAP_SERVER_DOWN (0x51) from Directory Server server_name due to Kerberos ticket timeout.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is LDAP?
What is Kerberos?
From a newsgroup post: "We actually deleted a user who was part of Domain Admin Group and had SeInteractiveLogon right on the Domain Controller GPO. When this user was deleted, the permissions on Default GPO and Default DC GPO still existed. This user account in one or more Group policy objects (GPOs) could not be resolved to a SID. We were able to trace this user from %SYSTEMROOT%\Security\Logs\winlogon.log and remove him from the GPOs too. We Rebooted the server and we could see Event ID 2080 which meant that things are normal".
As per Microsoft: "This event will be seen if Diagnostics Logging on the LDAP category of DSAccess is set to Minimum for the server. This event indicates that DSAccess terminated the existing Lightweight Directory Access Protocol (LDAP) connection because the Kerberos ticket expired. The user operation will be retried, and the domain controller will still be used by DSAccess". See MSEX2K3DB for more details.
As per ME329272: "This problem may occur if Kerberos tickets expire on the Exchange 2000 server. These error messages are informational. The default time to live (TTL) for a Kerberos ticket is 10 hours".
|Private comment: Subscribers only. See example of private comment|
|Links: ME329272, EventID 2080 from source MSExchangeDSAccess, MSEX2K3DB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated