4771 - Kerberos Failure

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771

Event ID 4771 is a critical event in Windows security auditing, indicating a Kerberos pre-authentication failure. This event is logged on the domain controller that receives the pre-authentication request and plays a vital role in monitoring and diagnosing issues related to Kerberos authentication processes. Understanding the details and substatus codes of Event ID 4771 is crucial for identifying authentication issues, potential attack vectors, and maintaining secure access controls.

Key Details of Event ID 4771

• Log Location: Security log on domain controllers.

• Category: Audit Kerberos Authentication Service

• Level: Failure Audit.

When It Is Logged

Event ID 4771 is logged when a Kerberos pre-authentication request fails. This can occur in various scenarios, such as:

• Incorrect user password entries.

• Attacks attempting to guess passwords.

• Configuration or communication issues between the client and the domain controller.

Information Contained in the Log

An Event ID 4771 log contains several pieces of information crucial for diagnosing authentication issues:

• Client Address: Shows the IP address of the client from which the logon attempt was made.

• Client Port: Indicates the port number used by the client machine for the connection.

• Pre-authentication Type: Specifies the type of pre-authentication used, often indicating the use of passwords (type 2).

• Failure Code: A key element that specifies why the pre-authentication failed.

• User Name: The name of the user for whom the logon attempt was made.

• Service Name: The name of the service that was requested, typically the Kerberos Ticket Granting Service (TGS).

• Ticket Options: Specifies various flags related to the ticket that was requested.

Common Failure Codes and Their Meanings

Understanding the failure codes provided in Event ID 4771 logs is essential for diagnosing and addressing authentication issues:

• 0x18: Pre-authentication information was invalid. This often indicates an incorrect password was entered.

• 0x12: Account restrictions are preventing this user from signing in. For example: not allowed to log in from this computer, logon hours restrictions, or account disabled.

• 0x25: The user has to reset their password.

• 0x1F: An unspecified error has occurred.

Importance for Security

Event ID 4771 is instrumental in security monitoring for several reasons:

• Detecting Brute-Force Attacks: Multiple 4771 events with failure code 0x18 from the same client address may indicate a brute-force password guessing attack.

• Identifying Configuration Issues: Failures related to account restrictions (code 0x12) can highlight misconfigurations that may inadvertently prevent legitimate access.

• Password Attack Detection: An unusually high volume of 4771 events across various accounts might signal a more extensive password spray attack.

Tools and Strategies for Analysis

• Windows Event Viewer: Manually inspect the Security log on domain controllers for 4771 events.

• PowerShell: Automate the extraction and analysis of 4771 events from domain controllers' logs.

• SIEM Systems: Aggregate and correlate 4771 events with other security logs to detect patterns indicative of attacks or systemic issues.