where IT meets experience
After I replaced my Windows 2003 Domain Controllers for fresh new Windows 2008 R2 domain controllers, I was starting to have problems at my remote offices.
In the eventlog on my remote pc’s, I found the following events:
Event ID: 40960
Source: LsaSrv
Type: Warning
Category: SPNEGO (Negotiator)
Description: The Security System detected an attempted downgrade attack for server <server name>.
The following error may appear in your Eventlog. The error mostly occurs without notice.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10020
Date: 30-12-2008
Time: 10:05:12
User: %username%
Computer: %computername%
Description:
The machine wide Default Launch and Activation security descriptor is invalid. It contains Access Control Entries with permissions that are invalid.… Read the rest
In all recent server editions of Windows, shutting down or rebooting a server always requires a reason to perform the action. This is an action performed by the Shutdown Event Tracker service.
In a production environment, I can only encourage to keep this annoying screen because it saves you from accidentally rebooting a server.… Read the rest