To Err is divine

Have you ever wondered what do the hex codes in the Windows Server event viewer meant?

Event Type:    Failure Audit
Event Source:    Security
Event Category:    Account Logon
Event ID:    675
Date:        8/18/2010
Time:        3:45:54 PM
User:        NT AUTHORITY\SYSTEM
Computer:    ComputerName
Description:
Pre-authentication failed:
User Name:    username
User ID:        Domainname\username
Service Name:    krbtgt/domainname.suffix
Pre-Authentication Type:    0x2
Failure Code:    0x18
Client Address:    xx.yy.zz.kk

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Using the err tool with 0x18 code, it reveals the following:

F:\>err 0x18
# for hex 0x18 / decimal 24 :
BTH_ERROR_PAIRING_NOT_ALLOWED                                 bthdef.h
REFERENCE_BY_POINTER                                          bugcodes.h
EVENT_MSCEP_FAIL_NUMBER_FROM_MESSAGE                          ceplog.mc
# SCEP Add-on cannot find the certificate’s serial number in
# the client’s PKCS7 message (%2).  %3  Please find support
# information at http://%1/certsrv/mscep/mscephlp.htm.
MSG_E_CANNOT_GET_CSP                                          certlog.mc
# Certificate Services did not start: Unable to get
# certificate server CSP information from registry for %1.
# %2.
CR_APM_VETOED                                                 cfgmgr32.h
LOG_MODULE_LKQRM                                              clusvmsg.h
LLC_STATUS_INVALID_BUFFER_LENGTH                              dlcapi.h
IAAPI_BADIDENTIFIER                                           iaapi.h
# /* Bad identifier in a parsing display value */
KDC_ERR_PREAUTH_FAILED                                        kerberr.h
# Pre-authentication information was invalid
POLICY_ERRV_SUBNET_UNAUTH_USER_FLOW_RATE                      lpmapi.h
MAPI_DIAG_ALPHABETIC_CHARACTER_LOST                           mapidefs.h
MSIDBERROR_BADKEYTABLE                                        msiquery.h
# table in KeyTable column of _Validation table could not be
# found/loaded
NRC_SABORT                                                    nb30.h
# /* session ended abnormally                   */
NDDE_CANT_ACCESS_SERVER                                       nddeapi.h
NMERR_OUT_OF_RANGE                                            netmon.h
OLE_ERROR_NOT_LINK,                                           ole.h
# Not a linked object                     */
MSG_DOMHIER_PEER_TIMEOUT                                      w32timemsg.mc
# Time Provider NtpClient: No valid response has been
# received from domain controller %1
# after 8 attempts to contact it. This domain controller will
# be
# discarded as a time source and NtpClient will attempt to
# discover a
# new domain controller from which to synchronize.
ERROR_BAD_LENGTH                                              winerror.h
# The program issued a command but the command length is
# incorrect.
# 18 matches found for “0x18”

Nice?  Err tool pulls together all the error headers and returns all possible occurrence of the error code.  It does not give you an definite answer the cause, but it points the possible way.  This is originally an Exchange Server tool, but it works for Windows Server problems too.  Watch your path.

Download it here