My domain admin accpunt is constantly getting locked out. I am seeing numerous 4771 ids on the DC that shows the most lockouts. Any idea?
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 9/5/2013 10:35:47 AM
Event ID: 4771
Task Category: Kerberos Authentication Service
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DC.domain.com
Description:
Kerberos pre-authentication failed.
Account Information:
Security ID:
domain\machine$
Account Name:machine$
Service Information:
Service Name:
krbtgt/domain.COM
Network Information:
Client Address:::ffff:10.190.1.6
Client Port:
51819
Additional Information:
Ticket Options:0x40000000
Failure Code:
0x18
Pre-Authentication Type:2
Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Certificate information is only provided if a certificate was used for pre-authentication.
Pre-authentication types, ticket options and failure codes are defined in RFC 4120.
If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4771</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14339</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2013-09-05T17:35:47.449854500Z" />
<EventRecordID>4950613833</EventRecordID>
<Correlation />
<Execution ProcessID="604" ThreadID="9732" />
<Channel>Security</Channel>
<Computer>DC.domain.com</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">machine$</Data>
<Data Name="TargetSid">S-1-5-21-1702431690-1831029836-1105138716-117926</Data>
<Data Name="ServiceName">krbtgt/domain.COM</Data>
<Data Name="TicketOptions">0x40000000</Data>
<Data Name="Status">0x18</Data>
<Data Name="PreAuthType">2</Data>
<Data Name="IpAddress">::ffff:10.190.1.6</Data>
<Data Name="IpPort">51819</Data>
<Data Name="CertIssuerName">
</Data>
<Data Name="CertSerialNumber">
</Data>
<Data Name="CertThumbprint">
</Data>
</EventData>
</Event>