ZEKASTRA

SecurityKerberos and NTLM authentication

4771 · Kerberos pre-authentication failed

Generated on domain controllers when the KDC fails to issue a TGT because pre-authentication failed. Status 0x18 usually means a wrong password.

01Fields in the event

  • TargetUserName
  • TargetSid
  • ServiceName
  • TicketOptions
  • Status
  • PreAuthType
  • IpAddress
  • IpPort
  • CertIssuerName
  • CertSerialNumber
  • CertThumbprint

02How to use it

Count failures per account and per IpAddress in short windows to identify password guessing or spraying. Compare with 4740 lockouts and later successful 4768 for the same account.

03Caveats

Requires Audit Kerberos Authentication Service. Not generated for accounts set to "Do not require Kerberos preauthentication". Certificate fields are always empty in this event.

05Sources

  1. Microsoft Learn — 4771(F) Kerberos pre-authentication failed checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.