Event ID 4771: Kerberos pre-authentication failed
Written on domain controllers when a Kerberos logon fails before a ticket is issued, most often because of a wrong password.
- Log
- Security
- Category
- Kerberos
Why it matters
- Failure Code 0x18 is a wrong password. Many 0x18s across many accounts from one client is password spraying.
- Kerberos failures do not appear as 4625 on the domain controller, so spraying can be missed if you only watch 4625.
What to check
Group by Client Address and Failure Code, and check the spread of Account Names.
How to turn it on
Advanced Audit Policy on domain controllers: Account Logon > Audit Kerberos Authentication Service (Failure).
Kerberos failure codes
| Code | Name | Meaning |
|---|---|---|
| 0x6 | KDC_ERR_C_PRINCIPAL_UNKNOWN | The user name does not exist. |
| 0x12 | KDC_ERR_CLIENT_REVOKED | The account is disabled, expired or locked out. |
| 0x17 | KDC_ERR_KEY_EXPIRED | The password has expired. |
| 0x18 | KDC_ERR_PREAUTH_FAILED | Wrong password. |
| 0x25 | KRB_AP_ERR_SKEW | Clocks on the client and domain controller are too far apart. |
| 0xE | KDC_ERR_ETYPE_NOSUPP | The requested encryption type is not supported. |
MITRE ATT&CK
- T1110.003 Password Spraying
- T1110 Brute Force