Windows Event ID 4771: Kerberos pre-authentication failed
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Event ID 4771 records a Kerberos pre-authentication failure on a domain controller.
Technical Metadata
| Event ID | 4771 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Failure |
| MITRE ATT&CK | TA0006 Credential Access / T1110.001 Brute Force: Password Guessing; TA0006 Credential Access / T1110.003 Brute Force: Password Spraying |
| Key fields to watch | Failure Code, Pre-Authentication Type, Client Address |
Trigger Scenarios
The KDC generates the event when a client cannot satisfy Kerberos pre-authentication.
Key Fields
Failure Code
0x18 is KDC_ERR_PREAUTH_FAILED, normally a bad password; 0x12 is KDC_ERR_CLIENT_REVOKED for disabled or locked accounts.
Pre-Authentication Type
2 commonly represents encrypted timestamp pre-authentication; compare deviations with client configuration.
Client Address
The source IP used to group attempts and identify the originating device.
Threat Hunting Queries
SecurityEvent
| where EventID == 4771
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4771
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4771- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4771
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4771
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| FailureCode | 0x18 | Kerberos preauthentication information was invalid, commonly because the password-derived key was wrong. | Repeated 0x18 failures against one account support password-guessing triage; the same client across many accounts supports password-spray triage. Source |
| FailureCode | 0x12 | The client's credentials were revoked, such as a disabled, expired, or locked account. | Separate revoked-account noise from bad-password activity before calculating brute-force breadth. Source |
MITRE ATT&CK Mapping
- T1110.001Brute Force: Password Guessing
- T1110.003Brute Force: Password Spraying
Detection Notes
T1110.001 Password Guessing appears as repeated FailureCode 0x18 against one TargetUserName, while T1110.003 Password Spraying appears as 0x18 across many accounts from one IpAddress. Exclude FailureCode 0x12 revoked-account cases, then correlate any later 4768 success and 4624 logon from the same client.
Common False Positives
- Stale credentials in services and mobile devices are common.
- Users entering old passwords after rotation create 0x18 failures.
Related Events
Sample Log
Account Name: [email protected]
Client Address: 10.x.x.x
Failure Code: 0x18
Pre-Authentication Type: 2Frequently Asked Questions
What does Windows Event ID 4771 mean?
Event ID 4771 records failed Kerberos preauthentication on a domain controller and includes the account, client address, preauthentication type, and failure code.
Which 4771 code is commonly associated with a bad password?
FailureCode 0x18 means the preauthentication information was invalid and is commonly generated when the password-derived key is wrong.
How do password guessing and spraying differ in 4771?
Many 0x18 failures against one account support guessing, while one client address producing 0x18 across many accounts supports spraying after service and stale-credential baselining.
Sources
- 4771: Microsoft Windows security auditing event reference
Microsoft · vendor
- Brute Force: Password Guessing (T1110.001)
MITRE ATT&CK · attack
- Brute Force: Password Spraying (T1110.003)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule