Microsoft-Windows-Kerberos-Key-Distribution-Center

Fields #

Fields #

Fields #

Fields #

Fields #

Description

The password on the KRBTGT account was changed.

Message #

The password on the KRBTGT account was changed.

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Fields #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Fields #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "{3FD9DA1A-5A54-46C5-9A26-9BD7C0685056}",
    "event_source_name": "KDC",
    "event_id": 37,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T17:05:19.030305+00:00",
    "event_record_id": 10648,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "IssuingKDC": "LAB-DC01",
    "ClientRealm": "LUDUS.DOMAIN",
    "ClientName": "domainadmin",
    "ServerName": "krbtgt",
    "Binary": ""
  },
  "message": ""
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Fields #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Fields #

Description

AS exchange performance: AS-REQ processing begins.

Description

AS exchange performance: AS-REQ processing begins.

Message #

AS exchange performance: AS-REQ processing begins

Description

AS exchange performance: AS-REP or KRB-ERROR returned.

Fields #

References #

• RFC 4120 §7.5.9 Kerberos error codes https://datatracker.ietf.org/doc/html/rfc4120#section-7.5.9
• RFC 4556 §6 PKINIT error codes https://datatracker.ietf.org/doc/html/rfc4556#section-6

Description

AS exchange performance: AS-REP or KRB-ERROR returned.

Message #

AS exchange performance: AS-REP or KRB-ERROR returned:

    client domain: %1
    client name: %2
    server domain: %3
    server name: %4
    ErrorCode: %5
    elapse: %6 milliseconds

Fields #

Description

TGS exchange performance: TGS-REQ processing begins.

Description

TGS exchange performance: TGS-REQ processing begins.

Message #

TGS exchange performance: TGS-REQ processing begins

Description

TGS exchange performance: TGS-REQ or KRB-ERROR returned.

Fields #

References #

• RFC 4120 §7.5.9 Kerberos error codes https://datatracker.ietf.org/doc/html/rfc4120#section-7.5.9
• RFC 4556 §6 PKINIT error codes https://datatracker.ietf.org/doc/html/rfc4556#section-6

Description

TGS exchange performance: TGS-REQ or KRB-ERROR returned.

Message #

TGS exchange performance: TGS-REQ or KRB-ERROR returned:

    client domain: %1
    client name: %2
    server domain: %3
    server name: %4
    ErrorCode: %5
    elapse: %6 milliseconds

Fields #

Description

Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.

Message #

Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.

Account Information:
	Security ID: %2
	Account Name: %1

Service Information:
	Service Name: %3

Network Information:
	Client Address: %7
	Client Port: %8

Additional Information:
	Ticket Options: %4
	Failure Code: %5
	Pre-Authentication Type: %6

Certificate Information:
	Certificate Issuer Name: %9
	Certificate Serial Number: %10
	Certificate Thumbprint: %11

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Fields #

Description

Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.

Fields #

Description

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

Message #

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

Account Information:
	Account Name: %1
	Supplied Realm Name: %2
	User ID: %3

Authentication Policy Information:
	Silo Name: %16
	Policy Name: %17
	TGT Lifetime: %18

Device Information:
	Device Name: %4

Service Information:
	Service Name: %5
	Service ID: %6

Network Information:
	Client Address: %11
	Client Port: %12

Additional Information:
	Ticket Options: %7
	Result Code: %8
	Ticket Encryption Type: %9
	Pre-Authentication Type: %10

Certificate Information:
	Certificate Issuer Name: %13
	Certificate Serial Number: %14
	Certificate Thumbprint: %15

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Fields #

Description

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

Fields #

Description

A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

Message #

A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

Account Information:
	Account Name: %1
	Account Domain: %2
	Logon GUID: %11

Authentication Policy Information:
	Silo Name: %13
	Policy Name: %14

Device Information:
	Device Name: %3

Service Information:
	Service Name: %4
	Service ID: %5

Network Information:
	Client Address: %8
	Client Port: %9

Additional Information:
	Ticket Options: %6
	Ticket Encryption Type: %7
	Failure Code: %10
	Transited Services: %12

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.

Fields #

Description

A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

Fields #

Description

The Key Distribution Center (KDC) failed to validate its current KDC certificate. This KDC might not be enabled for smart card or certificate authentication.

Message #

The Key Distribution Center (KDC) failed to validate its current KDC certificate. This KDC might not be enabled for smart card or certificate authentication.

Kdc Certificate Information:
  Issuer Name: %1
  Serial Number: %2
  Thumbprint: %3
  Template: %4
  Kerberos Error: %5
  Validation Error: %6

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "event_id": 120,
    "level": "Error",
    "task": "KDC",
    "opcode": "Info",
    "time_created": "2026-05-24T20:29:18.8212381+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational"
  },
  "event_data": {
    "SerialNumber": "4A00000026B37CA59821F6C9F7000000000026",
    "Issuer": "EvtGen-Root-CA",
    "Thumbprint": "83875CFCBB86E1C80DB97B6881A03763C0ABEFF9",
    "KerbErr": "74",
    "ErrorCode": "2148081683",
    "Template": "Kerberos Authentication"
  }
}

Description

The Key Distribution Center (KDC) cannot find a suitable certificate to use. This KDC is not enabled for smart card or certificate authentication.

Message #

The Key Distribution Center (KDC) cannot find a suitable certificate to use. This KDC is not enabled for smart card or certificate authentication.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "3FD9DA1A-5A54-46C5-9A26-9BD7C0685056",
    "event_source_name": "",
    "event_id": 200,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:16:26.074299+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 968,
      "thread_id": 7192
    },
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Description

The Key Distribution Center (KDC) detected usage that will be unsupported because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Fields #

Description

The Key Distribution Center (KDC) detected Cipher usage that will be unsupported because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Message #

The Key Distribution Center (KDC) detected %15 usage that will be unsupported because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types. 

Account Information
	Account Name: %1 
	Supplied Realm Name: %2 
	msds-SupportedEncryptionTypes: %3 
	Available Keys: %4 
  
Service Information: 
	Service Name: %5 
	Service ID: %6 
	msds-SupportedEncryptionTypes: %7 
	Available Keys: %8 

Domain Controller Information: 
	msds-SupportedEncryptionTypes: %9 
	DefaultDomainSupportedEncTypes: %10 
	Available Keys: %11 

Network Information: 
	Client Address: %12 
	Client Port: %13 
	Advertized Etypes: %14 

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) detected usage that will be unsupported because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Fields #

Description

The Key Distribution Center (KDC) detected Cipher usage that will be unsupported because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Message #

The Key Distribution Center (KDC) detected %15 usage that will be unsupported because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.   

Account Information  
	Account Name: %1 
	Supplied Realm Name: %2 
	msds-SupportedEncryptionTypes: %3 
	Available Keys: %4 

Service Information:  
	Service Name: %5 
	Service ID: %6 
	msds-SupportedEncryptionTypes: %7 
	Available Keys: %8 

Domain Controller Information:  
	msds-SupportedEncryptionTypes: %9 
	DefaultDomainSupportedEncTypes: %10 
	Available Keys: %11 

Network Information:  
	Client Address: %12 
	Client Port: %13 
	Advertized Etypes: %14 

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types.

Message #

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is not defined and the client only supports insecure encryption types. 

Account Information  
	Account Name: %1 
	Supplied Realm Name: %2 
	msds-SupportedEncryptionTypes: %3 
	Available Keys: %4 

Service Information:  
	Service Name: %5 
	Service ID: %6 
	msds-SupportedEncryptionTypes: %7 
	Available Keys: %8 

Domain Controller Information:  
	msds-SupportedEncryptionTypes: %9 
	DefaultDomainSupportedEncTypes: %10 
	Available Keys: %11 

Network Information:  
	Client Address: %12 
	Client Port: %13 
	Advertized Etypes: %14 

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Message #

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is not defined and the service account only has insecure keys.

Account Information
	Account Name: %1
	Supplied Realm Name: %2
	msds-SupportedEncryptionTypes: %3
	Available Keys: %4

Service Information:
	Service Name: %5
	Service ID: %6
	msds-SupportedEncryptionTypes: %7
	Available Keys: %8

Domain Controller Information:
	msds-SupportedEncryptionTypes: %9
	DefaultDomainSupportedEncTypes: %10
	Available Keys: %11

Network Information:
	Client Address: %12
	Client Port: %13
	Advertized Etypes: %14

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) detected explicit insecure cipher enablement in the Default Domain Supported Encryption Types policy configuration.

Fields #

Description

The Key Distribution Center (KDC) detected explicit insecure cipher enablement in the Default Domain Supported Encryption Types policy configuration.

Message #

The Key Distribution Center (KDC) detected explicit insecure cipher enablement in the Default Domain Supported Encryption Types policy configuration.

Cipher(s): %1
DefaultDomainSupportedEncTypes: %2

See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) detected Cipher usage that will be unsupported in enforcement phase because service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the client does not advertize AES-SHA1.

Message #

The Key Distribution Center (KDC) detected %15 usage that will be unsupported in enforcement phase because service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the client does not advertize AES-SHA1. ____Account Information___Account Name: %1 ___Supplied Realm Name: %2 ___msds-SupportedEncryptionTypes: %3 ___Available Keys: %4 __  __Service Information: ___Service Name: %5 ___Service ID: %6 ___msds-SupportedEncryptionTypes: %7 ___Available Keys: %8 ____Domain Controller Information: ___msds-SupportedEncryptionTypes: %9 ___DefaultDomainSupportedEncTypes: %10 ___Available Keys: %11 ____Network Information: ___Client Address: %12 ___Client Port: %13 ___Advertized Etypes: %14 ____See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) detected Cipher usage that will be unsupported in enforcement phase because the service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the service account does not have AES-SHA1 keys.

Message #

The Key Distribution Center (KDC) detected %15 usage that will be unsupported in enforcement phase because the service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the service account does not have AES-SHA1 keys.   ____Account Information  ___Account Name: %1 ___Supplied Realm Name: %2 ___msds-SupportedEncryptionTypes: %3 ___Available Keys: %4 ____Service Information:  ___Service Name: %5 ___Service ID: %6 ___msds-SupportedEncryptionTypes: %7 ___Available Keys: %8 ____Domain Controller Information:  ___msds-SupportedEncryptionTypes: %9 ___DefaultDomainSupportedEncTypes: %10 ___Available Keys: %11 ____Network Information:  ___Client Address: %12 ___Client Port: %13 ___Advertized Etypes: %14 ____See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the client does not advertize AES-SHA1.

Message #

The Key Distribution Center (KDC) blocked cipher usage because service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the client does not advertize AES-SHA1. ____Account Information  ___Account Name: %1 ___Supplied Realm Name: %2 ___msds-SupportedEncryptionTypes: %3 ___Available Keys: %4 ____Service Information:  ___Service Name: %5 ___Service ID: %6 ___msds-SupportedEncryptionTypes: %7 ___Available Keys: %8 ____Domain Controller Information:  ___msds-SupportedEncryptionTypes: %9 ___DefaultDomainSupportedEncTypes: %10 ___Available Keys: %11 ____Network Information:  ___Client Address: %12 ___Client Port: %13 ___Advertized Etypes: %14 ____See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the service account does not have AES-SHA1 keys.

Message #

The Key Distribution Center (KDC) blocked cipher usage because the service msds-SupportedEncryptionTypes is configured to only support AES-SHA1 but the service account does not have AES-SHA1 keys. ____Account Information___Account Name: %1___Supplied Realm Name: %2___msds-SupportedEncryptionTypes: %3___Available Keys: %4____Service Information:___Service Name: %5___Service ID: %6___msds-SupportedEncryptionTypes: %7___Available Keys: %8____Domain Controller Information:___msds-SupportedEncryptionTypes: %9___DefaultDomainSupportedEncTypes: %10___Available Keys: %11____Network Information:___Client Address: %12___Client Port: %13___Advertized Etypes: %14____See https://go.microsoft.com/fwlink/?linkid=2344614 to learn more.

Fields #

Description

The Key Distribution Center (KDC) is being started.

Message #

The Key Distribution Center (KDC) is being started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "3FD9DA1A-5A54-46C5-9A26-9BD7C0685056",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T21:48:07.889406+00:00",
    "event_record_id": 21,
    "correlation": {},
    "execution": {
      "process_id": 936,
      "thread_id": 2856
    },
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Description

The Key Distribution Center (KDC) has stopped with error code: ErrorCode.

Message #

The Key Distribution Center (KDC) has stopped with error code: %1

Fields #

Description

The Key Distribution Center (KDC) uses the below KDC certificate for smart card or certificate authentication.

Message #

The Key Distribution Center (KDC) uses the below KDC certificate for smart card or certificate authentication.

Kdc Certificate Information:
  Issuer Name: %1
  Serial Number: %2
  Thumbprint: %3
  Template: %4

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "guid": "3FD9DA1A-5A54-46C5-9A26-9BD7C0685056",
    "event_source_name": "",
    "event_id": 302,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:17:39.777902+00:00",
    "event_record_id": 15,
    "correlation": {},
    "execution": {
      "process_id": 968,
      "thread_id": 9364
    },
    "channel": "Microsoft-Windows-Kerberos-Key-Distribution-Center/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Issuer": "EvtGen-Root-CA",
    "SerialNumber": "4A000000035FD5C8BB1377E3DC000000000003",
    "Thumbprint": "DB0FEA9B641F3814FC5168AE83EF7839AF1BB012",
    "Template": "DomainController"
  },
  "message": ""
}

Description

A Kerberos ticket-granting-ticket (TGT) was issued for a member of the Protected User group.

Message #

A Kerberos ticket-granting-ticket (TGT) was issued for a member of the Protected User group.

Account Information:
	Account Name: %1
	Supplied Realm Name: %2
	User ID: %3

Authentication Policy Information:
	Silo Name: %16
	Policy Name: %17
	TGT Lifetime: %18

Device Information:
	Device Name: %4

Service Information:
	Service Name: %5
	Service ID: %6

Network Information:
	Client Address: %11
	Client Port: %12

Additional Information:
	Ticket Options: %7
	Result Code: %8
	Ticket Encryption Type: %9
	Pre-Authentication Type: %10

Certificate Information:
	Certificate Issuer Name: %13
	Certificate Serial Number: %14
	Certificate Thumbprint: %15

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Fields #

Description

A Kerberos ticket-granting-ticket (TGT) was issued for a member of the Protected User group.

Fields #