Microsoft windows security auditing 4771

What is Event ID 4771: Kerberos Pre-Authentication Failed. Event ID 4771 is a common error message that is generated by the Windows security auditing feature. It typically indicates that a user’s Kerberos pre-authentication attempt has failed.

In this article, we’ll explore the causes and consequences of this error message and discuss best practices for troubleshooting and resolving it.

What is Kerberos Pre-Authentication?

Kerberos is a widely used network authentication protocol in Windows. It provides secure authentication for network resources by using a ticket based system. When a user attempts to access a network resource, Kerberos creates a ticket that contains the user’s authentication information. The user then presents this ticket to the network resource to gain access.

To ensure the security of the authentication process Kerberos uses pre-authentication which is a process of checking user’s credentials before granting them access to a network resource. Windows encrypts the user’s password and sends it to the Kerberos server for validation during pre-authentication. Windows grants user a ticket for accessing network resources, if the password is correct.

What is Event ID 4771?

Event ID 4771 is a type of event log message generated by the Windows system’s security auditing feature. This message is logged after a failed user’s Kerberos pre-authentication attempt. The message contains information about the user, the computer, and the reason for the authentication failure.

The message contains:

• Logon Account: The user account used to log on to the computer.
• Source Workstation: Contains the name of the computer from which the user attempted to log on.
• Error Code: Contains the error code that the Kerberos pre-authentication process returned.

The error code provides valuable information about the cause of the authentication failure. Common error codes include:

• 0x18: This error code indicates an account lockout.
• 0x6: The user’s password has expired.
• 0x12: The user’s account is no longer active.
• 0x24: The user’s password is incorrect.

What Causes Event ID 4771?

There are several reasons why a Kerberos pre-authentication attempt might fail and generate Event ID 4771. The most common causes include:

1. Incorrect Password: If a user enters an incorrect password during the pre-authentication process, Kerberos rejects the authentication attempt and generate this Event ID.
2. Expired Password: If a user’s password has expired, Kerberos generates this event ID.
3. Locked Out Account: If the Windows locks out a user due to too many failed login attempts, Kerberos rejects the authentication attempt and generates Event ID.
4. Disabled Account: If Windows disables the account of a user, Kerberos rejects the authentication attempt and generates Event ID 4771.
5. Clock Skew: If there is a significant difference in time between the client and the server, Kerberos generates this event ID.
6. Malware or Other Security Threats: Sometimes, malware and other other security threats on the network cause this Event ID.

What are the Consequences of Event ID 4771?

Event ID 4771 can have several consequences for users and network administrators. For users, the most immediate consequence is the inability to access network resources. If a user’s Kerberos pre-authentication attempt fails, they are not be granted a ticket to access network resources, even if their password is correct.

For network admins, this event could indicate more dire implications. A large number of such Event ID messages indicate a potential security threat on the network, such as a brute force attack or a malware infection. Additionally, if this Event ID messages are ignored, this could lead to a loss of network security and data breaches.

How to Troubleshoot and Resolve Event ID 4771?

To troubleshoot and resolve Event ID 4771, network admins should follow the following best practices:

1. Analyse the Event Log: The first step in troubleshooting this event ID is to analyse the event log message. The error code contained in the message provides valuable information about the cause of the authentication failure.
2. Check the User Account: The second step is to check the user account associated with the failed authentication attempt. This may include checking the user’s password status, account status, and lockout status.
3. Check the Source Workstation: Network admin should also check the source workstation associated with the failed authentication attempt. This may include checking the computer’s security status and antivirus software.
4. Check the Time Synchronization: Time synchronization issues cause clock skew and lead to authentication failures. Therefore check the time synchronization settings on the client and server.
5. Check for Malware and Security Threats: If Event ID 4771 messages continue to occur, network admins should check for malware and other security threats on the network.
6. Reset Passwords and Unblock Accounts: If the cause of the authentication failure is due to an incorrect password or a locked-out account, network administrators should reset passwords and unblock accounts as needed.
7. Implement Multi-Factor Authentication: Multi-factor authentication provides an additional layer of security and prevent brute-force attacks. Network admins should consider implementing multi-factor authentication on the network.
8. Monitor the Event Log: Finally, network administrators should monitor the event log for Event ID 4771 messages and take appropriate action as needed: investigating potential security threats and implementing additional security measures.

What is Event ID 4771: Kerberos Pre-Authentication Failed Conclusion

Event ID 4771 is a common error message that is generated by the Windows security auditing feature. It indicates that a user’s Kerberos pre-authentication attempt has failed.

To troubleshoot and resolve it, network administrators should follow best practices that include analysing the event log, checking user accounts and source workstations, checking time synchronization, checking for malware and security threats, resetting passwords and unblocking accounts, implementing multi-factor authentication, and monitoring the event log.

By following these best practices, you can prevent security threats, ensure network security, and provide a secure environment for users to access network resources.

What is Kerberos?

Kerberos is a network authentication protocol used in Windows domains. It is used to verify the identity of users and computers across an untrusted network such as the internet. Kerberos support is built into all major computer operating systems, including Microsoft Windows.

Pre-authentication is an initial step in the Kerberos process where the client proves its identity to the Key Distribution Center (KDC).

Since Windows 2000, the Kerberos protocol has been used by Microsoft as the default authentication method, and it is a fundamental part of the Windows Active Directory (AD) service.

What is Event ID 4771?

Event ID 4771, “Kerberos pre-authentication failed,” is a common security event in Windows environments.

This event generates every time the Key Distribution Center (KDC) fails to issue a Kerberos Ticket Granting Ticket (TGT) and indicates that the Key Distribution Center (KDC) could not validate the client’s initial identity claim. The event is logged on domain controllers.

Note that this event is not generated if the “Do not require Kerberos preauthentication” option is set for the account.

Картинка с сайта: www.lepide.com

The following are some of the common causes for event ID 4771 to be generated:

How Lepide Auditor Helps

It is essential that an administrator has visibility over what is happening in their Active Directory. This ensures that any suspicious activity relating to potential security threats is identified and can be responded to immediately.

The Lepide Active Directory Auditing Tool enables effective monitoring, auditing, and reporting on all Active Directory states and changes including account logon events. The Lepide Auditor includes pre-configured account logon reports to help identify malicious users attempting to logon to machines that require elevated privileges.

Active Directory

This event is logged on domain controllers only and only failure instances of this event are logged.

At the beginning of the day when a user sits down at his or her workstation and enters his domain username and password, the workstation contacts a local DC and requests a TGT. If the username and password are correct and the user account passes status and restriction checks, the DC grants the TGT and logs event ID  4768 (authentication ticket granted).  

If the ticket request fails Windows will either log this event, failure 4771, or 4768 if the problem arose during «pre-authentication».  In Windows Kerberos, password verification takes place during pre-authentication.

The User field for this event (and all other events in the Audit account logon event category) doesn’t help you determine who the user was; the field always reads N/A. Rather look at the Account Information: fields, which identify the user who logged on and the user account’s DNS suffix. The User ID field provides the SID of the account. 

Windows logs other instances of event ID 4768 when a computer in the domain needs to authenticate to the DC typically when a workstation boots up or a server restarts. In these instances, you’ll find a computer name in the User Name and fields. Computer generated kerberos events are always identifiable by the $ after the computer account’s name.

Supercharger Enterprise

Картинка с сайта: www.ultimatewindowssecurity.com

Load Balancing for Windows Event Collection

Examples of 4771

Kerberos pre-authentication failed.

Account Information:

   Security ID:  ACME\administrator
   Account Name:  Administrator

Service Information:

   Service Name:  krbtgt/acme

Network Information:

   Client Address:  ::ffff:10.42.42.224
   Client Port:  50950

Additional Information:

   Ticket Options:  0x40810010
   Failure Code:  0x18
   Pre-Authentication Type: 2

Certificate Information:

   Certificate Issuer Name: 
   Certificate Serial Number: 
   Certificate Thumbprint: 

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

• Insider Gone Bad: Tracking Their Steps and Building Your Case with the Security Log
• Building a Security Dashboard for Your Senior Executives
• 27 Most Important Windows Security Events
• 5 Ways to Reduce Information Overload from Your Log Management/SIEM
• Daily Security Log Check for the SMB IT Admin
• Integrating Splunk with native Windows Event Collection (WEC) and Optional 2-Stage Noise Filtering
• How to do Logon Session Auditing with the Windows Security Log
• Top Windows Security Log Events for User Behavior Analysis
• 4 Threat Detections using Active Directory Authentication Events from the Windows Security Log
• Understanding Active Directory Authentication Events in the Windows Security Log and Beyond
• Security Log Deep Dive: Mapping Active Directory Authentication and Account Management Events to MITRE ATT&CK TTPs
• Detecting and Preventing AD Authentication Risks: Golden Tickets, NTLM, Pass-the-Hash and Beyond
• Windows Security Log Deep Dive: Understanding Kerberos Authentication Events from Domain Controllers
• Assessing the Security of Your Active Directory: User Accounts
• The Changing Landscape of Authentication and Logon Tracking in Hybrid Environments of Entra and AD