Event ID 675

Event ID 675 – Pre-authentication failed

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 675
Computer: xxx
Description:
Pre-authentication failed:
User Name: xxx
User ID: xxxx\yyyy
Service Name: xxxx\xxxx
Pre-Authentication Type: 0x##
Failure Code: ##
Client Address: IP address

Error Code	Cause
6	The username doesn’t exist.
12	Workstation restriction; logon time restriction.
18	Account disabled, expired, or locked out.
23	The user’s password has expired.
24	Pre-authentication failed; usually means bad password
32	Ticket expired. This is a normal event that get frequently logged by computer accounts.
37	The workstation’s clock is too far out of synchronization with the DC’s clock.

Case 1: An Intern user account is expired.

Case 2: The user tried to logon after he was fired and the account was disabled.

Case 3: The password for the IWAM_ServerName account was changed, which didn’t match the IIS metabase.

Case 4: The logon time restriction rejects a user logon at evening.

Case 5: The user types incorrect password..

Case 6: The user changed the password in his desktop while his laptop connect to the domain TS using the old password.

Case 7: After the client upgraded their domain controller form windows 2003 to 2008, some users have the problem to logon. Disjoin the computer and re-join it to the domain. that fixes the problem.

Case 8: I just had this event appear on my domain controller for a user who could not log onto one of our file servers. Turns out, he had saved a domain password in his MS Passport. The domain password was changed while Passport stored password did not change. Windows continued sending the old password when the login script was processed. The Passport stored passwords can be accessed in XP from Control Panel - User Accounts.

Case 9: The user had logon before and never logoff. After he changed the password, he can't logon until we logoff him manually.

Case 10: We gave the user a new computer with the same host name as old one. The user can't logon. We fixed it by remove the computer account from the Active Directory and re-add it.

Case 11: Check the DNS records and see if that machine's name and IP address are correct there. I had a very similar error in my logs and it was DNS related. Netdiag found the problem for me. The machine failed the dns test (fatal). The records for that machine were missing. Added them back in and problem solved.

Case 12: All users we tried to logon a computer has the same issue. Finally, we find the computer time is different from the server. Re-set time to match the correct time.

Mode cases can be found this post: Event ID 675

Event ID Troubleshooting

Event ID: 1000 - The safe mode service of Windows SharePoint Services has failed to initialize because of an unknown error. ...
http://www.chicagotech.net/wineventid.htm

logon failed

Logon Failure: The target account name is incorrect Logon failure: the user has not been granted the requested logon type at this computer when browsing a ...
http://www.chicagotech.net/logonfailure.htm