Event ID: 4771

Kerberos pre-authentication failed

Kerberos pre-authentication failed.

Account Information:
    Security ID:        %2
    Account Name:       %1

Service Information:
    Service Name:       %3

Network Information:
    Client Address:     %7
    Client Port:        %8

Additional Information:
    Ticket Options:     %4
    Failure Code:       %5
    Pre-Authentication Type:    %6

Certificate Information:
    Certificate Issuer Name:    %9
    Certificate Serial Number:  %10
    Certificate Thumbprint:     %11

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Kerberos Ticket Flag Table: (TicketOptions)

In the table below “MSB 0” bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left.

MSB illustration

The most common values:

0x40810010 - Forwardable, Renewable, Canonicalize, Renewable-ok
0x40810000 - Forwardable, Renewable, Canonicalize
0x60810010 - Forwardable, Forwarded, Renewable, Canonicalize, Renewable-ok

Bit Flag Name Description
0 Reserved -
1 Forwardable (TGT only). Tells the ticket-granting service that it can issue a new TGT—based on the presented TGT—with a different network address based on the presented TGT.
2 Forwarded Indicates either that a TGT has been forwarded or that a ticket was issued from a forwarded TGT.
3 Proxiable (TGT only). Tells the ticket-granting service that it can issue tickets with a network address that differs from the one in the TGT.
4 Proxy Indicates that the network address in the ticket is different from the one in the TGT used to obtain the ticket.
5 Allow-postdate Postdated tickets SHOULD NOT be supported in KILE (Microsoft Kerberos Protocol Extension).
6 Postdated Postdated tickets SHOULD NOT be supported in KILE (Microsoft Kerberos Protocol Extension).
7 Invalid This flag indicates that a ticket is invalid, and it must be validated by the KDC before use. Application servers must reject tickets which have this flag set.
8 Renewable Used in combination with the End Time and Renew Till fields to cause tickets with long life spans to be renewed at the KDC periodically.
9 Initial Indicates that a ticket was issued using the authentication service (AS) exchange and not issued based on a TGT.
10 Pre-authent Indicates that the client was authenticated by the KDC before a ticket was issued. This flag usually indicates the presence of an authenticator in the ticket. It can also flag the presence of credentials taken from a smart card logon.
11 Opt-hardware-auth This flag was originally intended to indicate that hardware-supported authentication was used during pre-authentication. This flag is no longer recommended in the Kerberos V5 protocol. KDCs MUST NOT issue a ticket with this flag set. KDCs SHOULD NOT preserve this flag if it is set by another KDC.
12 Transited-policy-checked KILE MUST NOT check for transited domains on servers or a KDC. Application servers MUST ignore the TRANSITED-POLICY-CHECKED flag.
13 Ok-as-delegate The KDC MUST set the OK-AS-DELEGATE flag if the service account is trusted for delegation.
14 Request-anonymous KILE not use this flag.
15 Name-canonicalize In order to request referrals the Kerberos client MUST explicitly request the "canonicalize" KDC option for the AS-REQ or TGS-REQ.
16-25 Unused -
26 Disable-transited-check By default the KDC will check the transited field of a TGT against the policy of the local realm before it will issue derivative tickets based on the TGT. If this flag is set in the request, checking of the transited field is disabled. Tickets issued without the performance of this check will be noted by the reset (0) value of the TRANSITED-POLICY-CHECKED flag, indicating to the application server that the transited field must be checked locally. KDCs are encouraged but not required to honor the DISABLE-TRANSITED-CHECK option. Should not be in use, because Transited-policy-checked flag is not supported by KILE.
27 Renewable-ok The RENEWABLE-OK option indicates that a renewable ticket will be acceptable if a ticket with the requested life cannot otherwise be provided, in which case a renewable ticket may be issued with a renew-till equal to the requested end time. The value of the renew-till field may still be limited by local limits, or limits selected by the individual principal or server.
28 Enc-tkt-in-skey No information.
29 Unused -
30 Renew The RENEW option indicates that the present request is for a renewal. The ticket provided is encrypted in the secret key for the server on which it is valid. This option will only be honored if the ticket to be renewed has its RENEWABLE flag set and if the time in its renew-till field has not passed. The ticket to be renewed is passed in the padata field as part of the authentication header.
31 Validate This option is used only by the ticket-granting service. The VALIDATE option indicates that the request is to validate a postdated ticket. Should not be in use, because postdated tickets are not supported by KILE.

ISO 27001:2013 12.4.1
NIST 800-171: 3.1.8
NIST SP 800-53: AC-7
PCI 3.2.1: 10.2.4
HIPAA: 164.308 (a)(5)(ii)(C)

Generates every time the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). This can occur when a domain controller doesn’t have a certificate installed for smart card authentication (for example, with a “Domain Controller” or “Domain Controller Authentication” template), the user’s password has expired, or the wrong password was provided.

This event is not generated if “Do not require Kerberos preauthentication” option is set for the account.

This auditing subcategory monitors Kerberos AS_REQ requests.

Microsoft Documentation

Event ID - 4771

Name Field Insertion String OS Example
Account Name TargetUserName %1 Any UserName
Security ID TargetSid %2 Any S-1-5-21-3457937927-2839227994-823803824-1104
Service Name ServiceName %3 Any krbtgt/DOMAIN.LOCAL
Ticket Options TicketOptions %4 Any 0x40810010
Failure Code Status %5 Any View Codes
Pre-Authentication Type PreAuthType %6 Any View Codes
Client Address IpAddress %7 Any ::ffff:
Client Port IpPort %8 Any 49254
Certificate Issuer Name CertIssuerName %9 Any
Certificate Serial Number CertSerialNumber %10 Any
Certificate Thumbprint CertThumbprint %11 Any

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Kerberos Authentication Service"

LEFT/RIGHT arrow keys for navigation

Back to List