azureblog.co.uk
← cd ~/events
// events/107-kerberos · Windows Hello

Event ID 107KDC certificate does not have a matched domain name

The Kerberos client received a domain controller certificate whose names do not match the domain, seen with Entra joined key trust and non-Microsoft CAs. The log is off by default.

LogMicrosoft-Windows-Kerberos/Operational
SourceMicrosoft-Windows-Security-Kerberos
AreaWindows Hello

What to check

Reissue the DC certificates so the subject holds the DC's distinguished name, or the SAN holds the DC FQDN, domain FQDN and NetBIOS name.

Codes you'll see in this event

CodeMeaning
0xC000006DLogon failure reported with the mismatch.

Find it with PowerShell

Run on the machine that logs it.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Kerberos/Operational'; Id = 107 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-Kerberos/Operational log to your workspace, where it lands in the Event table.

kql5 lines
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-Kerberos/Operational" and EventID == 107
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Windows Hello events

  • Event ID 358: Device ready to enrol in Windows Hello for Business
  • Event ID 362: Windows Hello for Business provisioning will not be launched
  • Event ID 300: Windows Hello for Business key created and registered
  • Event ID 7001: Windows Hello for Business sign-in error
  • Event ID 1021: Client forbidden access to the ugs scope

Search all 123 event IDs →

Sources