Event ID 4771 — Kerberos pre-authentication failure
What does this event mean?
A domain controller rejected Kerberos pre-authentication for an account during a ticket request. A single 4771 event may be caused by a user typing the wrong password; repeated events from the same source can indicate a stale password stored in a service, scheduled task, or device.
Windows context / source
The event is recorded in the Security log of the domain controller that processes the Kerberos request. Useful fields include the account, client address, failure code, and pre-authentication type. These fields help distinguish a simple bad password from time synchronization, encryption, or stored-credential problems.
Likely causes
- The user entered an incorrect password
- An old password is still stored in a service, scheduled task, or device
- The client or domain clock is too far out of sync
- The account, encryption type, or Kerberos settings are incompatible
Diagnostic checks
- Read the Failure Code and exact event timestamp.
- Identify the Client Address or machine that sent the request.
- Check the account state and look for a recent password change or account lockout.
- Verify time synchronization between the client, domain controllers, and time source.
- On the source system, inspect services, scheduled tasks, mapped resources, or applications that may store credentials.
- Correlate the event with Kerberos and lockout events generated at the same time.
Resolution
Fix the identified cause by updating the stored secret, restoring correct time synchronization, or correcting Kerberos and account settings. Do not simply unlock the account if an application is still sending an old password, because the failure will return.
Validation after action
Repeat the affected authentication, confirm that it succeeds, and verify that no new 4771 event for the same source and account appears during the observation period.