Audit Failure event id 673 caused by svcSQLServer

  • I have been unable to find this on any other forum so I posting here in hopes someone can tell me if this event is a concern. It is happening on 2 servers. Sql 2008 Service pack 1 has not been applied.

    Event Type:Failure Audit

    Event Source:Security

    Event Category:Account Logon

    Event ID:673


    Time:6:20:00 AM




    Service Ticket Request:


    User Domain:


    Service ID:-

    Ticket Options:0x40810000

    Ticket Encryption Type:-

    Client Address:

    Failure Code:0x1B

    Logon GUID:-

    Transited Services:-

    For more information, see Help and Support Center at

  • The 0x1B indicates that the server principal is valid for user-to-user only. The thing that stands out to me is the service name. I'm not sure why it's the same as the user. Have you verified your SPNs are correct? I'm stretching here, because I can't find much on it, either.

    K. Brian Kelley

Viewing 2 posts - 1 through 1 (of 1 total)

You must be logged in to reply to this topic. Login to reply