Event ID 5378
The requested credentials delegation was disallowed by policy.The requested credentials delegation was disallowed by policy.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Credential Delegation Information:
Security Package: %5
User's UPN: %6
Target Server: %7
Credential Type: %8This event generates requested CredSSP credentials delegation was disallowed by CredSSP delegation policy. It typically occurs when CredSSP delegation for WinRM double-hop session was not set properly.
Auditing:
Conditional
Recommended when CredSSP delegation policies are defined.
Volume:
Low
In a healthy, well-configured environment, the expected volume for this event is Very Low.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"
LEFT/RIGHT arrow keys for navigation
Back to List