Forum Discussion
Kerberos Event ID 4771 (0x18) occurring for all domain users despite successful manual logons
Hello,
At one of our clients, we are experiencing repeated Kerberos Pre-Authentication Failed - Event ID 4771, with Failure Code 0x18, on the primary Domain Controller.
The issue affects all domain users. All users are able to log in manually without any issues using their credentials. However, Event ID 4771 failures continue to be generated in the background, including outside normal working hours.
From the Event ID 4771 entries, we can see authentication attempts originating from different internal systems, including user workstations, the secondary Domain Controller, and the proxy server.
As part of the troubleshooting, we performed the following command for one of the affected users in order to clear the Kerberos ticket cache:
klist purge
The cache was cleared successfully, but after monitoring the environment again, Event ID 4771 continued to be generated and the issue remained unchanged.
We would appreciate your assistance in identifying the root cause of these repeated Kerberos pre-authentication failures and advising us on the recommended next troubleshooting steps.
Thank you.
1 Reply
Failure code 0x18 normally indicates that Kerberos pre-authentication received an incorrect password. Since interactive logons work but failures continue in the background, I would look for stored or stale credentials rather than Kerberos tickets.
klist purge will not solve this because it removes issued Kerberos tickets; it does not stop a service or scheduled task from repeatedly trying an old password.
Start with the Account Name and Client Address fields in each 4771 event. On those source systems check scheduled tasks, Windows services, application pools, Credential Manager, mapped resources, monitoring/backup agents and proxy authentication.
I would especially investigate the proxy because you mentioned failures from that system. Correlating the timestamp, account and client IP should quickly identify which process is generating the requests.
