Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 6025 Source: PCNSSVC

Source
Level
Description
Password Change Notification Service received an RPC exception attempting to deliver a notification.

The password change notification target could not be authenticated.

User Action:
This usually happens under the following conditions:
1. The Service Principal Name (SPN) for the target has not been assigned to the Active Directory account used to host the target process.
2. The SPN is assigned to more than one Active Directory account.
3. The SPN is not properly formatted. The SPN must use the fully qualified domain name of the target system.
4. There is more than 5 minutes of time variance between this system and the target system.

Please verify that the SPN configuration and that the clocks on the two systems are synchronized to an authoritative time source.

Additional Details:
Comments
 
I was able to resolve these errors on my DCs by opening Identity Manager on our ILM server then going to tools, options, check the box to enable password synchronization.
This error occurs when the target is currently offline or not reachable. It can also be caused by incorrect user rights in ILM, see ME973807.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...