Windows Security Log Event ID 4771

4771: Kerberos pre-authentication failed

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event is logged on domain controllers only and only failure instances of this event are logged.

At the beginning of the day when a user sits down at his or her workstation and enters his domain username and password, the workstation contacts a local DC and requests a TGT. If the username and password are correct and the user account passes status and restriction checks, the DC grants the TGT and logs event ID  4768 (authentication ticket granted).  

If the ticket request fails Windows will either log this event, failure 4771, or 4768 if the problem arose during "pre-authentication".  In Windows Kerberos, password verification takes place during pre-authentication.

The User field for this event (and all other events in the Audit account logon event category) doesn't help you determine who the user was; the field always reads N/A. Rather look at the Account Information: fields, which identify the user who logged on and the user account's DNS suffix. The User ID field provides the SID of the account. 

Windows logs other instances of event ID 4768 when a computer in the domain needs to authenticate to the DC typically when a workstation boots up or a server restarts. In these instances, you'll find a computer name in the User Name and fields. Computer generated kerberos events are always identifiable by the $ after the computer account's name.

Result codes:

Result code	Kerberos RFC description	Notes on common failure codes
0x1	Client's entry in database has expired
0x2	Server's entry in database has expired
0x3	Requested protocol version # not supported
0x4	Client's key encrypted in old master key
0x5	Server's key encrypted in old master key
0x6	Client not found in Kerberos database	Bad user name, or new computer/user account has not replicated to DC yet
0x7	Server not found in Kerberos database	New computer account has not replicated yet or computer is pre-w2k
0x8	Multiple principal entries in database
0x9	The client or server has a null key	administrator should reset the password on the account
0xA	Ticket not eligible for postdating
0xB	Requested start time is later than end time
0xC	KDC policy rejects request	Workstation restriction
0xD	KDC cannot accommodate requested option
0xE	KDC has no support for encryption type
0xF	KDC has no support for checksum type
0x10	KDC has no support for padata type
0x11	KDC has no support for transited type
0x12	Clients credentials have been revoked	Account disabled, expired, locked out, logon hours.
0x13	Credentials for server have been revoked
0x14	TGT has been revoked
0x15	Client not yet valid - try again later
0x16	Server not yet valid - try again later
0x17	Password has expired	The user’s password has expired.
0x18	Pre-authentication information was invalid	Usually means bad password
0x19	Additional pre-authentication required*
0x1F	Integrity check on decrypted field failed
0x20	Ticket expired	Frequently logged by computer accounts
0x21	Ticket not yet valid
0x21	Ticket not yet valid
0x22	Request is a replay
0x23	The ticket isn't for us
0x24	Ticket and authenticator don't match
0x25	Clock skew too great	Workstation’s clock too far out of sync with the DC’s
0x26	Incorrect net address	IP address change?
0x27	Protocol version mismatch
0x28	Invalid msg type
0x29	Message stream modified
0x2A	Message out of order
0x2C	Specified version of key is not available
0x2D	Service key not available
0x2E	Mutual authentication failed	may be a memory allocation failure
0x2F	Incorrect message direction
0x30	Alternative authentication method required*
0x31	Incorrect sequence number in message
0x32	Inappropriate type of checksum in message
0x3C	Generic error (description in e-text)
0x3D	Field is too long for this implementation

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4771

Account Information:

• Account Name:  logon name of the account that just authenticated
• Supplied Realm Name: domain name of the account
• User ID:   SID of the account 

Service Information:

• Service Name:  always "krbtgt"
• Service ID:

Network Information:

• Client Address:  IP address where user is present
• Client Port:  source port

Additional Information:

• Ticket Options:  unknown.  Please start a discussion if you have information to share on this field.
• Failure Code:  error if any - see table above 
• Pre-Authentication Type: unknown.  Please start a discussion if you have information to share on this field.

Certificate Information:

This information is only filled in if logging on with a smart card. 

• Certificate Issuer Name:
• Certificate Serial Number:
• Certificate Thumbprint:

 

Supercharger Free Edition

Centrally manage WEC subscriptions.

Free.

 

Mini-Seminars Covering Event ID 4771 Insider Gone Bad: Tracking Their Steps and Building Your Case with the Security Log Building a Security Dashboard for Your Senior Executives 27 Most Important Windows Security Events 5 Ways to Reduce Information Overload from Your Log Management/SIEM Daily Security Log Check for the SMB IT Admin Integrating Splunk with native Windows Event Collection (WEC) and Optional 2-Stage Noise Filtering How to do Logon Session Auditing with the Windows Security Log Top Windows Security Log Events for User Behavior Analysis 4 Threat Detections using Active Directory Authentication Events from the Windows Security Log Understanding Active Directory Authentication Events in the Windows Security Log and Beyond Security Log Deep Dive: Mapping Active Directory Authentication and Account Management Events to MITRE ATT&CK TTPs Detecting and Preventing AD Authentication Risks: Golden Tickets, NTLM, Pass-the-Hash and Beyond Windows Security Log Deep Dive: Understanding Kerberos Authentication Events from Domain Controllers

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy