SSOGEN / Free tools / Event ID 4771: Decode a Kerberos Pre-Authentication Failure, Free in Your Browser
Free tool
Event ID 4771: Decode a Kerberos Pre-Authentication Failure, Free in Your Browser
Event ID 4771 means a domain controller refused to issue a Kerberos ticket-granting ticket because the client could not prove the password. Paste the event into this free decoder for the failure code, the pre-authentication type and what to check next, in your browser, with nothing uploaded.
Paste an event and read it
Paste the text from Event Viewer, or the XML from its Details tab. To see the output first, select the Kerberos pre-auth failed (4771) sample button, which loads a fictional Acme event.
From Event Viewer: open the event, then copy the General text, or the XML from the Details tab (XML View). Events 4624, 4625, 4634, 4647, 4648, 4672, 4740, 4768, 4769, 4771 and 4776 are recognized.
Private by design. Decoding happens in this page and nothing is sent anywhere. Event text holds account names, host names and IP addresses: use a copy you are allowed to look at, and remove anything you must not share.
Free, in your browser. No sign-up and no limit. The page makes no network request when you decode, so the event never leaves your computer.
An event still contains account names and client addresses, so use a copy you are allowed to view.
What event 4771 records
Event ID 4771 is the Windows Security log entry “Kerberos pre-authentication failed”. A domain controller writes it when it cannot issue a Kerberos ticket-granting ticket (TGT). Microsoft gives three usual reasons:
- a wrong password;
- an expired password;
- a smart card logon where the domain controller has no suitable certificate.
The Failure Code field tells you which one applies, and the table below lists the codes Microsoft documents.
This free decoder reads a pasted event and explains it.
What pre-authentication is
When a user signs in to a Windows domain, the computer asks a domain controller for a TGT. The domain controller acts as the Key Distribution Center (KDC), and this first exchange is the Authentication Service (AS) exchange.
If the KDC issued a ticket to anyone who asked, the reply would be encrypted with the account’s password-derived key. An attacker could then request replies for any account name and attack them offline.
Pre-authentication closes that gap:
- The client first sends proof that it holds the key, normally the current time encrypted with that key. This is pre-authentication type 2, PA-ENC-TIMESTAMP, which Microsoft calls the normal type for standard password authentication.
- The KDC checks the proof.
- Only then does it issue the TGT.
RFC 4120 calls pre-authentication optional but recommended, and gives the reason: without it, “the authentication server does not know whether the client is actually the principal named in the request”, and an attacker can obtain known plaintext to attack.
Event 4771 records that proof failing.
For the full ticket flow, see what is Kerberos. For the sign-in experience, see the Kerberos authentication page.
Why you see 4771 and not 4768 for a wrong password
Event 4768 is “a Kerberos authentication ticket (TGT) was requested”, and a non-zero result code marks a failure.
Microsoft’s page states that 4768 is not generated for result codes 0x10 and 0x18; event 4771 is generated instead. The page gives no reason, so treat it as a property of the log.
In practice, that means two searches on a domain controller:
- Wrong password at the Kerberos stage (0x18) or smart card trouble (0x10): search for 4771.
- Everything else that stops a TGT (nonexistent user, disabled account, clock skew and so on): search for 4768 and read the result code.
The Microsoft 4771 page also reproduces the full RFC 4120 error table, but explains causes only for 0x10, 0x17 and 0x18.
For the other codes, the cause text comes from the 4768 page and is quoted below. Both pages are archived Windows 10 documentation.
Where it is logged and how to turn it on
- Where. Only domain controllers generate 4771; a workstation or member server never writes it. Look on the domain controller that answered the request, and in a domain with several, check each one.
- The audit subcategory. Microsoft files the event under Audit Kerberos Authentication Service. Failure events appear only when that subcategory audits failures.
- An empty log. Check the audit policy before you suspect the network.
- One more rule. Microsoft’s 4771 page says no event is generated if the account has Do not require Kerberos preauthentication set. That account option is covered below.
Failure codes
Read Failure Code first. The names are the RFC 4120 names.
“What Microsoft says” is Microsoft’s own wording: the 4771 page for 0x10, 0x17 and 0x18, and the 4768 page for the others. The right-hand column is our reading of where to look, not Microsoft’s text.
| Failure Code | Name | What Microsoft says | What to check |
|---|---|---|---|
| 0x18 | KDC_ERR_PREAUTH_FAILED | Pre-authentication information was invalid. The wrong password was provided. | Mistyped or stale saved password; a service or scheduled task holding an old one; or guessing |
| 0x17 | KDC_ERR_KEY_EXPIRED | Password has expired; change password to reset. | The user must change the password |
| 0x10 | KDC_ERR_PADATA_TYPE_NOSUPP | KDC has no support for the pre-authentication data type. A smart card logon where the proper certificate cannot be located, or the domain controller has no certificate for smart cards. | Domain Controller or Domain Controller Authentication certificate on the controller; the CA being queried |
| 0x6 | KDC_ERR_C_PRINCIPAL_* | Client not found in Kerberos database. The username does not exist. | A typo, or a list of guessed names if it repeats |
| 0x7 | KDC_ERR_S_PRINCIPAL_* | Server not found in Kerberos database. The controller cannot find the server’s name in Active Directory. | The service name (SPN) |
| 0x8 | KDC_ERR_PRINCIPAL_NOT_UNIQUE | Multiple principal entries. Duplicate principal names exist. | Duplicate SPNs |
| 0xC | KDC_ERR_POLICY | Usually logon restrictions on the account: workstation restriction, smart card requirement or logon time restriction. | The account’s logon hours, permitted workstations and smart card setting |
| 0x12 | KDC_ERR_CLIENT_REVOKED | Credentials revoked. An explicit disabling or other restrictions: disabled, expired or locked out. | Whether the account is disabled, expired or locked out |
| 0x25 | KRB_AP_ERR_SKEW | Clock skew too great. A timestamp differs from the server’s by more than the tolerance set in Kerberos policy. | Clocks on the client and the controller |
Other codes exist in the RFC 4120 list that the Microsoft page reproduces.
One example is 0x19 (additional pre-authentication required), which Microsoft says often appears with UNIX clients that normally answer and then succeed. If the decoder meets a code it does not list, it says so.
What each cause looks like and the fix
- Wrong password (0x18). The most common cause. For a user, it is usually a typo. If it repeats at a steady rate, look for a saved credential, a mapped drive or a phone that still uses the old password. For a service account, the password was changed in one place and not the other.
- Expired password (0x17). The password reached its maximum age. The user changes it, or an administrator resets it.
- Disabled, expired or locked account (0x12). Microsoft’s text on the 4768 page covers “disabled, expired, or locked out”. Open the account in Active Directory to see which. For a lockout, the event 4740 decoder shows how to read the caller computer, and the event ID 4625 page walks through that chain.
- Logon hours or workstation restriction (0xC). The password may be correct; the account is not allowed to sign in at this time or from this computer.
- Clock skew (0x25). Covered in the next section.
- Smart card certificate (0x10). The password is not the issue: the domain controller cannot validate the certificate path. This code is also the fastest way to find smart card problems in the log.
Clock skew and the five-minute default
Kerberos messages carry timestamps so that a captured message cannot be replayed later. That protection works only when the client’s clock and the domain controller’s clock are close.
Microsoft’s Maximum tolerance for computer clock synchronization policy sets the largest difference Kerberos accepts. The default and recommended value is 5 minutes, and RFC 4120 uses “e.g., 5 minutes” as its own example.
When the difference is larger, the KDC returns KRB_AP_ERR_SKEW (0x25). Do not widen the tolerance.
Find the machine with the wrong clock, for example:
- a virtual machine resumed from a snapshot;
- a device with a dead clock battery;
- a computer outside the domain’s time hierarchy.
Fix the time source, and the error clears on the next attempt.
“Do not require Kerberos preauthentication” accounts
In Active Directory, an account can have the option Do not require Kerberos preauthentication. For that account the KDC skips the proof step and returns the encrypted TGT response to anyone who asks.
This has two consequences:
- No 4771. As noted above, Microsoft says 4771 is not generated for such an account, so a failed attempt against it leaves no 4771.
- A security risk. Microsoft’s 4768 monitoring table says a pre-authentication type of 0 means pre-authentication was not used. It says all accounts should use pre-authentication except accounts configured this way, and that this option “is a security risk”.
RFC 4120 gives the same reason as above: the server cannot tell who is asking, and the attacker gets known plaintext to work on.
Keep a list of accounts with this option set. For each one, confirm whether a specific legacy system still needs it, and clear the option if not.
Password spraying, and how it looks in 4771
Password spraying tries one or two common passwords against many accounts and stays under lockout thresholds.
Microsoft’s guidance for 0x18 is to watch for many events in a short time, which “can indicate a brute-force attack on the account password, especially for highly critical accounts”.
For 4771 it also suggests tracking events whose Client Address is outside your internal ranges.
The table below applies that guidance to spraying. It is our interpretation, not a Microsoft rule:
| What you see | Likely story |
|---|---|
| One 0x18 for one person, from their usual workstation, then a 4768 success | A typo |
| A slow, steady 0x18 for one person from one workstation | A stale saved password |
| Many 0x18 events, each for a different account, all from one Client Address | Spraying: one source, many names |
| Many 0x18 events for one account from an address that is not theirs | Guessing against that account |
| 0x18 mixed with 0x6 for names that do not exist | Someone trying a list of names (Microsoft says repeated 0x6 can indicate enumeration) |
Check the Pre-Authentication Type as well. Microsoft’s table says to look for any value other than 2 where only password logon is in use.
Spotting these patterns reliably needs a tool that counts events over time, which this page does not do.
For the related attack that replays leaked username and password pairs, see credential stuffing.
Next steps from a 4771
- Read Failure Code and Pre-Authentication Type first.
- Note Account Name and Client Address. The address is the computer that sent the request, which is usually where a saved password lives.
- Check the account in Active Directory: disabled, locked out, expired, logon hours, permitted workstations and the preauthentication option.
- If you see 0x25, compare the clocks on that client and the domain controller.
- Search for the same address across other accounts.
If a Windows desktop sign-in through SSOGEN fails, the Windows desktop sign-in guide lists the same kinds of cause on the SSOGEN side, including a clock more than five minutes out.
The SSO audit log is SSOGEN’s own record, kept separately from your Windows event logs.
What is event ID 4771?
What is Kerberos pre-authentication?
What does Failure Code 0x18 mean in event 4771?
Why is a wrong Kerberos password event 4771 and not 4768?
What does failure code 0x25 mean?
Where do I find event 4771?
What is the difference between event ID 4771 and 4625?
Where to go next
- More diagnostics. Browse the other free tools.
- A failed logon. Decode it with the event ID 4625 decoder.
- The NTLM side. Read it in the event ID 4776 decoder.
- A successful logon. See it in the event ID 4624 decoder.
Sources, all read 2026-10-09: Microsoft Learn’s pages for events 4771 and 4768, Microsoft Learn’s Maximum tolerance for computer clock synchronization, and RFC 4120. Microsoft and Windows are trademarks of their owner; SSOGEN is not affiliated with Microsoft. Check the SPN with the SPN checker.