Kerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771

A failed Kerberos request in Active Directory leaves a hex code behind: a Result Code in event 4768, a Failure Code in 4769 or 4771, or a KDC_ERR or KRB_AP_ERR name in a System log event. This quick reference decodes the codes Microsoft documents for those events, adds the KDC events behind the recent RC4 and certificate-mapping hardening, and gives the usual cause and the first check for each.

How to read these codes#

On Windows Server 2016 and later with the January 14, 2025 or later cumulative update, 4768 and 4769 also show the account's, service's and DC's msDS-SupportedEncryptionTypes, their available keys, the client's advertised encryption types and the session key type, which makes encryption failures easy to read. The Client Address field tells you which machine sent the request. To pull recent failures from a DC:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768,4769,4771} -MaxEvents 2000 |
    ForEach-Object {
        $d = @{}
        ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
        [pscustomobject]@{ Time = $_.TimeCreated; Event = $_.Id; Account = $d.TargetUserName
                           Service = $d.ServiceName; Client = $d.IpAddress; Code = $d.Status }
    } | Where-Object Code -ne '0x0' | Format-Table -AutoSize

On a client or member server, set LogLevel (REG_DWORD) to 1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters; errors then appear in the System log. Remove the value afterwards: it also logs expected errors such as KDC_ERR_PREAUTH_REQUIRED (see Enable Kerberos event logging).

Account, password and pre-authentication#

Services and SPNs#

The client-side twin of 0x29 is System log event 4: The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server. The Exchange alternate service account guide shows the classic load-balancer case.

Encryption types and RC4#

The warning events (201, 202, 206, 207) were logged during audit mode; under enforcement you see their blocking counterparts (203, 204, 208, 209). AES keys are created when a password is set, so an old service account password is the most common reason for "insecure keys":

Get-ADUser svc-app -Properties msDS-SupportedEncryptionTypes, PasswordLastSet
# AES only (reset the password first if it predates AES keys):
Set-ADUser svc-app -Replace @{'msDS-SupportedEncryptionTypes' = 0x18}
# A device that can't do AES and can't be fixed by its vendor: RC4 with AES session keys, this account only
Set-ADUser svc-app -Replace @{'msDS-SupportedEncryptionTypes' = 0x24}

Use Set-ADComputer or Set-ADServiceAccount for computer accounts and gMSAs. Microsoft's Detect and remediate RC4 usage in Kerberos covers the wider clean-up.

Time, replay and transport#

Smart cards and certificate mapping#

How to verify a fix#

1. On the client, clear cached tickets and request the service again: klist purge for the user, or klist -li 0x3e7 purge for the computer account. klist get HTTP/app.contoso.com requests a ticket directly.
2. klist lists a ticket for the SPN, and its KerbTicket Encryption Type is AES.
3. On the DC, the matching 4769 shows Failure Code 0x0 and Ticket Encryption Type 0x12 or 0x11 (AES), the expected values on current systems.
4. No new Kdcsvc 201 to 209 or 39 events name that account, and 4771 0x18 bursts from that Client Address have stopped.
5. Turn Kerberos LogLevel off again on any machine where you enabled it.

Replication errors that wrap Kerberos failures (5, 1396, -2146893022) are in Active Directory replication errors; Kerberos problems with Microsoft Entra Seamless SSO are covered in Seamless SSO not working.

References#

• 4768(S, F): A Kerberos authentication ticket (TGT) was requested (source of the code table); see also 4769 and 4771
• How to manage Kerberos KDC usage of RC4 (KB5073381, CVE-2026-20833)
• Detect and remediate RC4 usage in Kerberos