DFIRHub

Windows event log ยท Security4771 Kerberos pre-authentication failed

  • Security
  • 5 fields
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Fields EvtxECmd extracts

5 columns in the EvtxECmd CSV

  • RemoteHost%ipAddress%:%port%
    • %ipAddress% = /Event/EventData/Data[@Name="IpAddress"]
    • %port% = /Event/EventData/Data[@Name="IpPort"]
  • PayloadData1Target: %TargetUserName% (%TargetSid%)
    • %TargetUserName% = /Event/EventData/Data[@Name="TargetUserName"]
    • %TargetSid% = /Event/EventData/Data[@Name="TargetSid"]
  • PayloadData2ServiceName: %ServiceName%
    • %ServiceName% = /Event/EventData/Data[@Name="ServiceName"]
  • PayloadData3Status: %Status%
    • %Status% = /Event/EventData/Data[@Name="Status"]
  • PayloadData4PreAuthType: %PreAuthType%
    • %PreAuthType% = /Event/EventData/Data[@Name="PreAuthType"]

Value lookups

Codes that EvtxECmd turns into text

Status

0x10
KDC_ERR_PADATA_TYPE_NOSUPP - KDC has no support for PADATA type (pre-authentication data) - Smart card logon is being attempted and the proper certificate cannot be located. This problem can happen because the wrong certification authority (CA) is being queried or the proper CA cannot be contacted in order to get Domain Controller or Domain Controller Authentication certificates for the domain controller. It can also happen when a domain controller doesn't have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates).
0x17
KDC_ERR_KEY_EXPIRED - Password has expired-change password to reset - The user's password has expired.
0x18
KDC_ERR_PREAUTH_FAILED - Pre-authentication information was invalid - The wrong password was provided.

PreAuthType

0
Logon without Pre-Authentication.
2
PA-ENC-TIMESTAMP - This type is normal for standard password authentication.
11
PA-ETYPE-INFO - The ETYPE-INFO pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value. Never saw this Pre-Authentication Type in Microsoft Active Directory environment.
15
PA-PK-AS-REP_OLD - Used for Smart Card logon authentication.
16
PA-PK-AS-REQ - Request sent to KDC in Smart Card authentication scenarios.
17
PA-PK-AS-REP - This type should also be used for Smart Card authentication, but in certain Active Directory environments, it is never seen.
19
PA-ETYPE-INFO2 - The ETYPE-INFO2 pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value. Never saw this Pre-Authentication Type in Microsoft Active Directory environment.
20
PA-SVR-REFERRAL-INFO - Used in KDC Referrals tickets.
138
PA-ENCRYPTED-CHALLENGE - Logon using Kerberos Armoring (FAST). Supported starting from Windows Server 2012 domain controllers and Windows 8 clients.
-
This type shows in Audit Failure events.

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/>
    <EventID>4771</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>14339</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-07T18:10:21.495462300Z"/>
    <EventRecordID>166708</EventRecordID>
    <Correlation/>
    <Execution ProcessID="520" ThreadID="1084"/>
    <Channel>Security</Channel>
    <Computer>DC01.contoso.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="TargetUserName">dadmin</Data>
    <Data Name="TargetSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data>
    <Data Name="ServiceName">krbtgt/CONTOSO.LOCAL</Data>
    <Data Name="TicketOptions">0x40810010</Data>
    <Data Name="Status">0x10</Data>
    <Data Name="PreAuthType">15</Data>
    <Data Name="IpAddress">::ffff:10.0.0.12</Data>
    <Data Name="IpPort">49254</Data>
    <Data Name="CertIssuerName"/>
    <Data Name="CertSerialNumber"/>
    <Data Name="CertThumbprint"/>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4771.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)