authenticationactive-directorywindows-server-2008kerberosspn

Kerberos authentication ticket - Event ID 4768 - Audit failure


I am using kerberos to authenticate a user and its failing. Audit failure details in event viewer are following

A Kerberos authentication ticket (TGT) was requested.

Account Information:
    Account Name:        ax
    Supplied Realm Name:    TEST.COM
    User ID:            NULL SID

Service Information:
    Service Name:        krbtgt/TEST.COM
    Service ID:        NULL SID

Network Information:
    Client Address:        ::ffff:2.2.2.60
    Client Port:        38532

Additional Information:
    Ticket Options:        0x40800000
    Result Code:        0x6
    Ticket Encryption Type:    0xffffffff
    Pre-Authentication Type:    -

Certificate Information:
    Certificate Issuer Name:        
    Certificate Serial Number:    
    Certificate Thumbprint:        

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

The result code 0x6 means that user doesn't exist in Kerberos database but i have a user already configured in AD. This is windows server 2008 (non-R2) and user account name is "axtest" and User logon name is "ax/mytest". The domain name is test.com. From wireshark, i can see that my client is sending AS-REQ which has correct 2 name string items ax & mytest. I am not sure why is it failing.

enter image description here

enter image description here

enter image description here


Solution

  • I found the problem. Since i was running old Microsoft 2008 version, it was missing the hotfix (KB951191). Installing that resolved the issue.