The Negotiate Security Package is a specialized Security Support Provider (SSP) that acts as an application layer between the Security Support Provider Interface (SSPI) and the other SSPs. When an application calls into SSPI to log a security principal onto a network, it can specify an SSP to process that request. If the application specifies Negotiate, Negotiate analyzes the request and picks the best SSP to handle it. On a default install of Windows Server 2003, the Negotiate SSP will submit the logon request to Kerberos first as that is the preferred authentication protocol because, among other things, it supports mutual authentication. If Kerberos cannot process the request, Negotiate will fall back on NTLM. If, however, Kerberos can process the logon request, and the request fails with an authoritative error, Negotiate will not fall back on NTLM. The Negotiate SSP will log a 40960 event in the System log and include the error returned by Kerberos to explain why the logon request failed.
Event 40960 only logs the error returned by Kerberos. It does not log the name of the principal or the name of the client. In order to obtain this information, auditing for User Logon Failures must be enabled. By looking at the logon failure audit event logged at the same time as the SPNEGO event, more information about the logon failure can be obtained.