← cd ~/events
// events/4 · Kerberos
Event ID 4KRB_AP_ERR_MODIFIED from the server
A client presented a service ticket the server could not decrypt. The usual cause is the service principal name (SPN) registered on the wrong account, so users get access denied.
| Log | System |
|---|---|
| Source | Kerberos |
| Area | Kerberos |
What to check
Run setspn -Q <SPN> to find which account holds the SPN, remove it from the wrong account with setspn -D and add it to the right one with setspn -S.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 4 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the System log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "System" and EventID == 4
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Kerberos events
- Event ID 4768: A Kerberos authentication ticket (TGT) was requested
- Event ID 4769: A Kerberos service ticket was requested
- Event ID 4771: Kerberos pre-authentication failed