672SecurityAccount LogonAuthentication Ticket Request:
User Name: computer$
Supplied Realm Name: DOMAIN.LOCAL
User ID: -
Service Name: krbtgt/DOMAIN.LOCAL
Service ID: -
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: -
Pre-Authentication Type: -
Client Address: 192.168.1.122
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint: This Audit Failure started appearing when a domain machine was renamed but not rebooted yet. The "Result Code: 0x6" means "The username doesn't exist"
We got this audit failure from a user that was logged on to a terminal server with a disconnected session.
The user account was renamed while the user was technically still logged on to the terminal server, which resulted in the domain controller issuing the 672 audit failure.
"Client Address" pointed to the terminal server in this case.
This event was accompanied by a 40960 warning event in the system log from the terminal server.
Result Code: 0x12 means "Clients credentials have been revoked", usually the result of a disabled or removed user account.