[Samba] Event log 4768 audit failure

Uri Simchoni uri at samba.org
Wed Jun 8 18:28:34 UTC 2016

On 06/08/2016 06:38 PM, VigneshDhanraj G wrote:
> Hi all,
> Hi all,
> I upgraded samba from 4.2.9 to 4.2.12. After upgrade i am seeing numerous
> amount of kerberos errors in DC event. Event id- 4768(Audit Failure)
> A Kerberos authentication ticket (TGT) was requested.
> Account Information:
> Account Name: root
> Supplied Realm Name: TEST.LOCAL
> Service Information:
> Service Name: krbtgt/TEST.LOCAL
> Service ID: NULL SID
> There is no user as root in my DC and there is no functionality breakup. It
> is getting correct user name .But, by default first kerberos ticket
> requested by root. whenever samba is restarted or communicating with my
> system. Audit failure logs are dumped.
> I think it might be a regression issue from samba while fixing badlock.
> could anyone help regarding this issue?

Seen it too (in packet traces, 4.3.latest, net ads join -k, bundled
Heimdal), but have zero time to work on it at the moment. If none gets
there first I'll fix it in a couple of weeks (or at least look into it).
Haven't seen any functional impact until you mentioned that audit log.


More information about the samba mailing list