OpsVantage Tools
Tools Guides Event IDs opsvantage.net
Tools / Event IDs / Event ID 4771

Event ID 4771: kerberos pre-authentication failed

What Event ID 4771 (kerberos pre-authentication failed) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.

Log: Security · Severity: Low · MITRE ATT&CK T1110 · Updated 2026-11-03

Event ID 4771 is a failed Kerberos pre-authentication on a domain controller. In practice it is the domain-wide view of wrong passwords, and the first place password spraying against Active Directory shows up.

The fields that matter

FieldWhat it tells you
Account NameThe account that failed.
Client AddressWhere the attempt came from.
Failure Code0x18 wrong password, 0x12 account disabled, locked or expired, 0x17 password expired, 0x25 clock out of sync.

What is normal

Occasional 0x18 failures from users' own devices, and 0x25 from machines with a broken time sync.

When Event ID 4771 is suspicious

Common false positive: Devices with an old cached password produce steady 0x18 failures for one account. They also trigger lockouts (4740), which point to the device.

Find Event ID 4771 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4771; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4771
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated desc

Related events

FAQ

Why don't I see 4771 for user names that don't exist?

Unknown names fail before pre-authentication and are logged as 4768 with result 0x6.

What does failure code 0x25 mean?

The client clock is more than five minutes off the domain controller's. Fix time sync; it is not an attack.