Event ID 5378

The requested credentials delegation was disallowed by policy.

The requested credentials delegation was disallowed by policy.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:       %4

Credential Delegation Information:
    Security Package:   %5
    User's UPN: %6
    Target Server:  %7
    Credential Type:    %8


This event generates requested CredSSP credentials delegation was disallowed by CredSSP delegation policy. It typically occurs when CredSSP delegation for WinRM double-hop session was not set properly.

Auditing:     Conditional

Recommended when CredSSP delegation policies are defined.


Volume:     Low

In a healthy, well-configured environment, the expected volume for this event is Very Low.


Microsoft Documentation

Event ID - 5378



Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any S-1-5-21
Account Name SubjectUserName %2 Any dadmin
Account Domain SubjectDomainName %3 Any CONTOSO
Logon ID SubjectLogonId %4 Any 0x2b1e04
Security Package Package %5 Any CREDSSP
User's UPN UserUPN %6 Any dadmin@contoso
Target Server TargetServer %7 Any WSMAN/dc01.contoso.local
Credential Type CredType %8 Any %%8098


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"



LEFT/RIGHT arrow keys for navigation

Back to List