Kerberos Failure Codes (Events 4771 and 4768) for Investigators
When a domain account authenticates with Kerberos, the domain controller — not the computer the user sat at —
records the outcome. A failed request for a ticket-granting ticket is logged as event 4771
(Kerberos pre-authentication failed) or 4768 with a non-zero result code; a failed service-ticket
request as 4769. Each carries a Kerberos failure code such as 0x18, and in Microsoft
Sentinel's SecurityEvent table that code is in the Status column.
These codes matter because attacks against Active Directory increasingly go through Kerberos rather than NTLM:
tools that spray passwords or enumerate user names over Kerberos leave no 4625 on the target servers, only
4771 and 4768 on the domain controllers. A burst of 0x6 (unknown principal) from one address is
user enumeration; a burst of 0x18 (pre-authentication failed) across many accounts is password
spraying. Each page quotes Microsoft's definition from the event 4771 documentation verbatim and gives the KQL to
check your own domain controllers.
| Code | What it means | Password correct? | Triage |
|---|---|---|---|
| 0x6 KDC_ERR_C_PRINCIPAL_UNKNOWN | The domain controller could not find the requested account in its database — the name does not exist, and a run of these from one source is account enumeration. | No | medium |
| 0x12 KDC_ERR_CLIENT_REVOKED | The domain controller refused the ticket request because the account itself is barred from logging on — Microsoft's examples are an account that is disabled, expired or locked out — rather than because of anything about the password. | No | medium |
| 0x17 KDC_ERR_KEY_EXPIRED | The domain controller refused the ticket request because the account's password has expired and has to be changed before Kerberos will issue a ticket — routine for people, but a problem worth chasing when it hits service accounts or comes from an address you do not recognise. | Unclear | low |
| 0x18 KDC_ERR_PREAUTH_FAILED | The domain controller rejected the pre-authentication data sent with a ticket request — Microsoft's listed cause is that the wrong password was provided; repeated 0x18 events for one account are a brute-force indicator. | No | medium |
Code not listed here? Look up any Microsoft code — AADSTS, NTSTATUS and Kerberos, with Microsoft’s official text.
Group your Kerberos failures by account and source
Load a domain controller Security event export into the free browser analyzer to see 4771 and 4768 failures by account, source address and code, with password spraying and user enumeration flagged. Nothing is uploaded.