Fields #

Fields #

Fields #

Fields #

Fields #

Description

The password on the KRBTGT account was changed.

Message #

The password on the KRBTGT account was changed.

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "{3FD9DA1A-5A54-46C5-9A26-9BD7C0685056}",
    "event_source_name": "KDC",
    "event_id": 37,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T17:05:19.030305+00:00",
    "event_record_id": 10648,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "IssuingKDC": "LAB-DC01",
    "ClientRealm": "LUDUS.DOMAIN",
    "ClientName": "domainadmin",
    "ServerName": "krbtgt",
    "Binary": ""
  },
  "message": ""
}

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Description

AS exchange performance: AS-REQ processing begins.

Description

AS exchange performance: AS-REQ processing begins.

Message #

AS exchange performance: AS-REQ processing begins

Description

AS exchange performance: AS-REP or KRB-ERROR returned.

Fields #

Description

AS exchange performance: AS-REP or KRB-ERROR returned.

Message #

AS exchange performance: AS-REP or KRB-ERROR returned:

    client domain: %1
    client name: %2
    server domain: %3
    server name: %4
    ErrorCode: %5
    elapse: %6 milliseconds

Fields #

Description

TGS exchange performance: TGS-REQ processing begins.

Description

TGS exchange performance: TGS-REQ processing begins.

Message #

TGS exchange performance: TGS-REQ processing begins

Description

TGS exchange performance: TGS-REQ or KRB-ERROR returned.

Fields #

Description

TGS exchange performance: TGS-REQ or KRB-ERROR returned.

Message #

TGS exchange performance: TGS-REQ or KRB-ERROR returned:

    client domain: %1
    client name: %2
    server domain: %3
    server name: %4
    ErrorCode: %5
    elapse: %6 milliseconds

Fields #

Description

Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.

Message #

Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.

Account Information:
	Security ID: %2
	Account Name: %1

Service Information:
	Service Name: %3

Network Information:
	Client Address: %7
	Client Port: %8

Additional Information:
	Ticket Options: %4
	Failure Code: %5
	Pre-Authentication Type: %6

Certificate Information:
	Certificate Issuer Name: %9
	Certificate Serial Number: %10
	Certificate Thumbprint: %11

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Fields #

Description

Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.

Fields #

Description

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

Message #

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

Account Information:
	Account Name: %1
	Supplied Realm Name: %2
	User ID: %3

Authentication Policy Information:
	Silo Name: %16
	Policy Name: %17
	TGT Lifetime: %18

Device Information:
	Device Name: %4

Service Information:
	Service Name: %5
	Service ID: %6

Network Information:
	Client Address: %11
	Client Port: %12

Additional Information:
	Ticket Options: %7
	Result Code: %8
	Ticket Encryption Type: %9
	Pre-Authentication Type: %10

Certificate Information:
	Certificate Issuer Name: %13
	Certificate Serial Number: %14
	Certificate Thumbprint: %15

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Fields #

Description

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

Fields #

Description

A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

Message #

A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

Account Information:
	Account Name: %1
	Account Domain: %2
	Logon GUID: %11

Authentication Policy Information:
	Silo Name: %13
	Policy Name: %14

Device Information:
	Device Name: %3

Service Information:
	Service Name: %4
	Service ID: %5

Network Information:
	Client Address: %8
	Client Port: %9

Additional Information:
	Ticket Options: %6
	Ticket Encryption Type: %7
	Failure Code: %10
	Transited Services: %12

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.

Fields #

Description

A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

Fields #

Description

The Key Distribution Center (KDC) failed to validate its current KDC certificate. This KDC might not be enabled for smart card or certificate authentication.

Message #

The Key Distribution Center (KDC) failed to validate its current KDC certificate. This KDC might not be enabled for smart card or certificate authentication.

Kdc Certificate Information:
  Issuer Name: %1
  Serial Number: %2
  Thumbprint: %3
  Template: %4
  Kerberos Error: %5
  Validation Error: %6

Fields #

Description

The Key Distribution Center (KDC) cannot find a suitable certificate to use. This KDC is not enabled for smart card or certificate authentication.

Message #

The Key Distribution Center (KDC) cannot find a suitable certificate to use. This KDC is not enabled for smart card or certificate authentication.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "3FD9DA1A-5A54-46C5-9A26-9BD7C0685056",
    "event_source_name": "",
    "event_id": 200,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:16:26.074299+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 968,
      "thread_id": 7192
    },
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Description

The Key Distribution Center (KDC) detected usage that will be unsupported because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Fields #

Description

The Key Distribution Center (KDC) detected Cipher usage that will be unsupported because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Message #

The Key Distribution Center (KDC) detected %15 usage that will be unsupported because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types. 

Account Information
	Account Name: %1 
	Supplied Realm Name: %2 
	msds-SupportedEncryptionTypes: %3 
	Available Keys: %4 
  
Service Information: 
	Service Name: %5 
	Service ID: %6 
	msds-SupportedEncryptionTypes: %7 
	Available Keys: %8 

Domain Controller Information: 
	msds-SupportedEncryptionTypes: %9 
	DefaultDomainSupportedEncTypes: %10 
	Available Keys: %11 

Network Information: 
	Client Address: %12 
	Client Port: %13 
	Advertized Etypes: %14 

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) detected usage that will be unsupported because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Fields #

Description

The Key Distribution Center (KDC) detected Cipher usage that will be unsupported because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Message #

The Key Distribution Center (KDC) detected %15 usage that will be unsupported because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.   

Account Information  
	Account Name: %1 
	Supplied Realm Name: %2 
	msds-SupportedEncryptionTypes: %3 
	Available Keys: %4 

Service Information:  
	Service Name: %5 
	Service ID: %6 
	msds-SupportedEncryptionTypes: %7 
	Available Keys: %8 

Domain Controller Information:  
	msds-SupportedEncryptionTypes: %9 
	DefaultDomainSupportedEncTypes: %10 
	Available Keys: %11 

Network Information:  
	Client Address: %12 
	Client Port: %13 
	Advertized Etypes: %14 

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Message #

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types. 

Account Information  
	Account Name: %1 
	Supplied Realm Name: %2 
	msds-SupportedEncryptionTypes: %3 
	Available Keys: %4 

Service Information:  
	Service Name: %5 
	Service ID: %6 
	msds-SupportedEncryptionTypes: %7 
	Available Keys: %8 

Domain Controller Information:  
	msds-SupportedEncryptionTypes: %9 
	DefaultDomainSupportedEncTypes: %10 
	Available Keys: %11 

Network Information:  
	Client Address: %12 
	Client Port: %13 
	Advertized Etypes: %14 

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Message #

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Account Information
	Account Name: %1
	Supplied Realm Name: %2
	msds-SupportedEncryptionTypes: %3
	Available Keys: %4

Service Information:
	Service Name: %5
	Service ID: %6
	msds-SupportedEncryptionTypes: %7
	Available Keys: %8

Domain Controller Information:
	msds-SupportedEncryptionTypes: %9
	DefaultDomainSupportedEncTypes: %10
	Available Keys: %11

Network Information:
	Client Address: %12
	Client Port: %13
	Advertized Etypes: %14

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) detected explicit insecure cipher enablement in the Default Domain Supported Encryption Types policy configuration.

Fields #

Description

The Key Distribution Center (KDC) detected explicit insecure cipher enablement in the Default Domain Supported Encryption Types policy configuration.

Message #

The Key Distribution Center (KDC) detected explicit insecure cipher enablement in the Default Domain Supported Encryption Types policy configuration.

Cipher(s): %1
DefaultDomainSupportedEncTypes: %2

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) is being started.

Message #

The Key Distribution Center (KDC) is being started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "3FD9DA1A-5A54-46C5-9A26-9BD7C0685056",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T21:48:07.889406+00:00",
    "event_record_id": 21,
    "correlation": {},
    "execution": {
      "process_id": 936,
      "thread_id": 2856
    },
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Description

The Key Distribution Center (KDC) has stopped with error code: ErrorCode.

Message #

The Key Distribution Center (KDC) has stopped with error code: %1

Fields #

Description

The Key Distribution Center (KDC) uses the below KDC certificate for smart card or certificate authentication.

Message #

The Key Distribution Center (KDC) uses the below KDC certificate for smart card or certificate authentication.

Kdc Certificate Information:
  Issuer Name: %1
  Serial Number: %2
  Thumbprint: %3
  Template: %4

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "3FD9DA1A-5A54-46C5-9A26-9BD7C0685056",
    "event_source_name": "",
    "event_id": 302,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:17:39.777902+00:00",
    "event_record_id": 15,
    "correlation": {},
    "execution": {
      "process_id": 968,
      "thread_id": 9364
    },
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Issuer": "EvtGen-Root-CA",
    "SerialNumber": "4A000000035FD5C8BB1377E3DC000000000003",
    "Thumbprint": "DB0FEA9B641F3814FC5168AE83EF7839AF1BB012",
    "Template": "DomainController"
  },
  "message": ""
}

Description

A Kerberos ticket-granting-ticket (TGT) was issued for a member of the Protected User group.

Message #

A Kerberos ticket-granting-ticket (TGT) was issued for a member of the Protected User group.

Account Information:
	Account Name: %1
	Supplied Realm Name: %2
	User ID: %3

Authentication Policy Information:
	Silo Name: %16
	Policy Name: %17
	TGT Lifetime: %18

Device Information:
	Device Name: %4

Service Information:
	Service Name: %5
	Service ID: %6

Network Information:
	Client Address: %11
	Client Port: %12

Additional Information:
	Ticket Options: %7
	Result Code: %8
	Ticket Encryption Type: %9
	Pre-Authentication Type: %10

Certificate Information:
	Certificate Issuer Name: %13
	Certificate Serial Number: %14
	Certificate Thumbprint: %15

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Fields #

Description

A Kerberos ticket-granting-ticket (TGT) was issued for a member of the Protected User group.

Fields #

Description

A Kerberos service ticket was issued for a member of the Protected User group.

Message #

A Kerberos service ticket was issued for a member of the Protected User group.

Account Information:
	Account Name: %1
	Account Domain: %2
	Logon GUID: %11

Authentication Policy Information:
	Silo Name: %13
	Policy Name: %14

Device Information:
	Device Name: %3

Service Information:
	Service Name: %4
	Service ID: %5

Network Information:
	Client Address: %8
	Client Port: %9

Additional Information:
	Ticket Options: %6
	Ticket Encryption Type: %7
	Failure Code: %10
	Transited Services: %12

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.

Fields #

Description

A Kerberos service ticket was issued for a member of the Protected User group.

Fields #

Description

A Kerberos ticket-granting-ticket (TGT) was issued, but it will be denied when Authentication Policy is enforced because the device does not meet the access control restrictions.

Message #

A Kerberos ticket-granting-ticket (TGT) was issued, but it will be denied when Authentication Policy is enforced because the device does not meet the access control restrictions.

Account Information:
	Account Name: %1
	Supplied Realm Name: %2
	User ID: %3

Authentication Policy Information:
	Silo Name: %16
	Policy Name: %17
	TGT Lifetime: %18

Device Information:
	Device Name: %4

Service Information:
	Service Name: %5
	Service ID: %6

Network Information:
	Client Address: %11
	Client Port: %12

Additional Information:
	Ticket Options: %7
	Result Code: %8
	Ticket Encryption Type: %9
	Pre-Authentication Type: %10

Certificate Information:
	Certificate Issuer Name: %13
	Certificate Serial Number: %14
	Certificate Thumbprint: %15

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Fields #

Description

A Kerberos ticket-granting-ticket (TGT) was issued, but it will be denied when Authentication Policy is enforced because the device does not meet the access control restrictions.

Fields #

Message #

A Kerberos service ticket was issued, but it will be denied when Authentication Policy is enforced for a member of the Protected User group because the user, device, or both does not meet the access control restrictions.

Account Information:
	Account Name: %1
	Account Domain: %2
	Logon GUID: %11

Authentication Policy Information:
	Silo Name: %13
	Policy Name: %14

Device Information:
	Device Name: %3

Service Information:
	Service Name: %4
	Service ID: %5

Network Information:
	Client Address: %8
	Client Port: %9

Additional Information:
	Ticket Options: %6
	Ticket Encryption Type: %7
	Failure Code: %10
	Transited Services: %12

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.

Fields #

Fields #

Description

The Key Distribution Center (KDC) used the PKINIT protocol with encryption mode for the client ClientName.

Message #

The Key Distribution Center (KDC) used the PKINIT protocol with encryption mode for the client %1.

Fields #

Description

The Key Distribution Center (KDC) is unable to use the PKINIT protocol because the client ClientName requested encryption mode and the KDC does not support it.

Message #

The Key Distribution Center (KDC) is unable to use the PKINIT protocol because the client %1 requested encryption mode and the KDC does not support it.

Fields #

Description

The kerberos client used a hash algorithm for the PKINIT protocol that is being audited: Algorithm.

Message #

The kerberos client used a hash algorithm for the PKINIT protocol that is being audited: %1.

Fields #

Description

The kerberos client used a hash algorithm for the PKINIT protocol that is not suppported: Algorithm.

Message #

The kerberos client used a hash algorithm for the PKINIT protocol that is not suppported: %1.

Fields #

Description

The Kerberos client did not supply a supported encryption type for use with the PKINIT protocol using encryption mode.

Message #

The Kerberos client did not supply a supported encryption type for use with the PKINIT protocol using encryption mode.
 Client Principal Name: %1
 Client IP Address: %2
 Client Supplied NetBIOS Name: %3

Fields #

Description

The Key Distribution Center (KDC) has an invalid hash algorithm configuration for PKINIT. This might result in PKINIT failures.

Message #

The Key Distribution Center (KDC) has an invalid hash algorithm configuration for PKINIT. This might result in PKINIT failures.

Description

The Key Distribution Center (KDC) encountered invalid certificate strong name match policy.

Message #

The Key Distribution Center (KDC) encountered invalid certificate strong name match policy.

 Faulting line: %1

Fields #

Description

An unauthorized Kerberos client attempted to fetch DMSA keys.

Message #

An unauthorized Kerberos client attempted to fetch DMSA keys.

Error code: %1
Machine: %2
DMSA: %3
Migration State: %4

Fields #

Description

A Kerberos client attempted to fetch DMSA keys.

Message #

A Kerberos client attempted to fetch DMSA keys.

DMSA: %1
Machine: %2
Error Code: %3

Fields #

Description

A Kerberos authentication ticket (TGT) was requested.

Message #

A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name: %1
	Supplied Realm Name: %2
	User ID: %3

Service Information:
	Service Name: %4
	Service ID: %5

Fields #

Description

A Kerberos service ticket was requested.

Message #

A Kerberos service ticket was requested.

Account Information:
	Account Name: %1
	Account Domain: %2
	Logon GUID: %10

Service Information:
	Service Name: %3
	Service ID: %4

Fields #