← cd ~/events
// events/4771 · Kerberos
Event ID 4771Kerberos pre-authentication failed
The KDC refused to issue a TGT because pre-authentication failed. Logged only on domain controllers; this is where wrong-password Kerberos failures appear.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Kerberos |
What to check
A burst of 0x18 for one account suggests password guessing; check the Client Address to find the source. 0x10 usually points at smart card or DC certificate problems.
Codes you'll see in this event
| Code | Meaning |
|---|---|
0x10 | KDC_ERR_PADATA_TYPE_NOSUPP: often a smart card logon problem, such as a missing DC certificate. |
0x12 | KDC_ERR_CLIENT_REVOKED: credentials revoked (disabled, expired or locked). |
0x17 | KDC_ERR_KEY_EXPIRED: password has expired. |
0x18 | KDC_ERR_PREAUTH_FAILED: wrong password. |
0x25 | KRB_AP_ERR_SKEW: clock skew too great. |
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4771 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4771
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Kerberos events
- Event ID 4768: A Kerberos authentication ticket (TGT) was requested
- Event ID 4769: A Kerberos service ticket was requested
- Event ID 4: KRB_AP_ERR_MODIFIED from the server