Windows Security Log Event ID 5168

5168: Spn check for SMB/SMB2 fails.

On this page

• Description of this event
• Field level details
• Examples

Spn check for SMB/SMB2 fails.

This event is related to Extended Protection for Authentication in the Server service. SMB hardening. KB article

This event is new to Windows 2008 Release 2 and Windows 7. It does not appear in earlier versions of Windows.

We have not been able to produce this event.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 5168

Subject:
 Security ID:  %1
 Account Name:  %2
 Account Domain:  %3
 Logon ID:  %4

SPN: 
 SPN Name:  %5
 Error Code:  %6

Server Information:
 Server Names:  %7
 Configured Names:  %8
 IP Addresses:  %9

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Mini-Seminars Covering Event ID 5168 Managing File Share Security on Windows Servers

 

Upcoming Webinars Understanding the Multiple Layers of Privileged Access in Windows The Top 5 Challenges of Windows Event Collection – And How to Solve Them

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy