// REFERENCE
4771 — Kerberos pre-authentication failed
Log: Security
Medium risk
Kerberos pre-authentication failed (the DC-side equivalent of 4625 for Kerberos). Many 4771 with failure code 0x18 (bad password) betray brute force against the domain.
Related tools
Work with this in:
Related
4768
4768 — Kerberos TGT requested (AS-REQ) 4769
4769 — Kerberos service ticket requested (TGS-REQ) 4770
4770 — Kerberos service ticket renewed 4776
4776 — NTLM credential validation
4768 — Kerberos TGT requested (AS-REQ) 4769
4769 — Kerberos service ticket requested (TGS-REQ) 4770
4770 — Kerberos service ticket renewed 4776
4776 — NTLM credential validation
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.