Failure Audit for Event id 675

[rs <rsmade () gmail com>]

I am receiving a ton of Event 675 Failure Audits on my DC. Windows 2003 
Mixed mode Domain and this is the pdc emulator. The bulk of these are 
arriving as follows:

Event Type:     Failure Audit
Event Source:   Security
Event Category: Account Logon
Event ID:       675
Date:           4/17/2006
Time:           4:38:56 PM
User:           NT AUTHORITY\SYSTEM
Computer:       DC01
Description:
Pre-authentication failed:
        User Name:      Admin
        User ID:                OURDOMAIN\Admin
        Service Name:   krbtgt/OURDOMAIN
        Pre-Authentication Type:        0x2
        Failure Code:   0x18
        Client Address: 127.0.0.1

I can't identify any process using this account on the DC. A reboot did 
not solve the issue. A lot of searching on the we has pointed to time 
issues dealing with kerberos but that does not seem to be it. The 
strange part is the client address being 127.0.0.1. Could this just be a 
virus out on our network reporting 127.0.0.1 as its source during 
authentication attempts? Has anyone seen anything like this?

-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------