SOC Event Lookup
Event ID 4649LogonP2

Windows Event ID 4649: A replay attack was detected

Windows Security Event ID 4649 records a Kerberos replay condition where the domain controller returned KRB_AP_ERR_REPEAT to the client.

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-13

Trigger Scenarios

This event is generated on domain controllers when a Kerberos authenticator is replayed: Microsoft documents that the server name, client name, time, and microsecond fields matched recently cached authenticator data.

Key Fields

Credentials Which Were Replayed: Account Name / Account Domain

Identifies the Kerberos client account whose authenticator was replayed. This is the principal to compare with recent 4769 service ticket activity.

Request Type / Logon Process / Authentication Package

Shows the Kerberos request context. Authentication Package should be Kerberos for the replay scenario documented by Microsoft.

Workstation Name / Process ID / Process Name

Provides the client workstation and local process context available in the event schema for triage and packet-path review.

Common False Positives

  • Microsoft notes that network device configuration or routing problems can replay packets and trigger the same condition.
  • Kerberos infrastructure testing and load balancer changes can create benign repeats, but every occurrence still requires investigation.

Related Events

MITRE ATT&CK Mapping

  • T1550.003Use Alternate Authentication Material: Pass the Ticket

Detection Notes

Use threshold=1 occurrence on a domain controller: Microsoft recommends alerting and investigating Event 4649 because KRB_AP_ERR_REPEAT means the server name, client name, time, and microsecond fields matched recently cached Kerberos authenticator data. Treat this as T1550.003 Pass the Ticket when the replayed Account Name also has abnormal 4769 service ticket requests or follow-on 4624 network logons; if the same Workstation Name aligns with a recent network change, validate packet duplication before declaring compromise.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4649
| project TimeGenerated, Computer, Account
Splunk SPL
index=wineventlog EventCode=4649 | table _time, host
Sample Log
EventID: 4649
Credentials Which Were Replayed Account Name: svc-web
Account Domain: CORP
Request Type: KRB_AP_REQ
Authentication Package: Kerberos
Workstation Name: WS-042
Process ID: 0x1f4

Source

Official documentationMachine-readable JSON