AS Request and Pre-Authentication

KRB_AS_REQ

The client proves it holds the account's key before the DC will issue a TGT.

Kerberos
Client to domain controller
Kerberos, port 88

Why It Matters

Every Kerberos sign-in starts here, and a wrong password shows up here first, as event 4771 in the DC's Security log. Password guessing, stolen keys and accounts set to skip the proof all meet this message.

Where It Sits

The strip shows every step of the Kerberos sign-in, with this page's step marked. Each of the others links to its own page, and Step Through It opens the walk-through on the topic page.

KerberosStep Through It

Step 1 of 6, AS Request, ws-017 to dc-01
Step 2 of 6, AS Reply, dc-01 to ws-017
Step 3 of 6, TGS Request, ws-017 to dc-01
Step 4 of 6, TGS Reply, dc-01 to ws-017
Step 5 of 6, AP Request, ws-017 to srv-fin-01
Step 6 of 6, AP Reply, srv-fin-01 to ws-017

What Happens

The request names the account and its realm, the service it wants (krbtgt, the ticket-granting service) and the encryption types the client can use, all in the clear. Pre-authentication adds the current time encrypted with the account's key (PA-ENC-TIMESTAMP), so the DC knows the client holds that key before it answers. The DC decrypts the time with its own copy of the key and accepts it if it is within five minutes of its clock, the Kerberos policy default.

A wrong password fails with 0x18 and is written to the DC's Security log as event 4771, never as 4768, with the Client Address it came from. A name that does not exist fails as event 4768 with 0x6. An account set with "Do not require Kerberos preauthentication" is answered without any proof, and the Security log never shows a 4771 for it, so clear that setting on every account.

The encrypted timestamp is sealed with a key made from the password, so one captured on the wire can be guessed offline like any other sealed part. Kerberos armouring (FAST) wraps the exchange in a channel keyed from the computer's own TGT and replaces the timestamp with an encrypted challenge, which shows as Pre-Authentication Type 138 instead of 2. The computer's own sign-in cannot be armoured, since it has no TGT yet.

On DCs with the January 2025 updates, Pre-Authentication EncryptionType in event 4768 in the Security log names the key form that made the timestamp. RC4 (0x17) there, for an account whose Available Keys include AES, deserves a look, because a stolen NT hash makes this timestamp as well as the password does. Members of Protected Users cannot pre-authenticate with RC4 or DES at all.

What Is Sent

Each part of the message is listed with what it holds and what protects it. A part sealed with a key can be read only by whoever holds that key, and a part marked In the clear has no protection of its own.

Part	What It Holds	Protection and Who Can Read It
dana's name `cname, realm`	Who is signing in, which is dana in the realm CORP.EXAMPLE.	In the clearAnyone who sees the traffic can read it.
The ticket wanted `sname`	A ticket-granting ticket, named krbtgt/CORP.EXAMPLE.	In the clearAnyone who sees the traffic can read it.
Encryption types `etype`	The types ws-017 supports, in its order of preference.	In the clearAnyone who sees the traffic can read it.
Pre-authentication `PA-ENC-TIMESTAMP`	The current time, sealed so that only a holder of her key could have made it.	Encrypted with dana's AES keyOnly ws-017 and dc-01 can open it.

Failure Codes at This Step

A refused request writes its reason as a code, in Failure Code in event 4771 or in Result Code in event 4768, both in the domain controller's Security log. These are the codes this step produces.

Code	Meaning
0x6	No account has that name (event 4768)
0xC	A logon restriction on the account, such as allowed hours, allowed workstations or a smart card requirement
0x12	The account is disabled, expired or locked out
0x17	The password has expired
0x18	Wrong password, so pre-authentication failed (event 4771)
0x25	The clocks differ by more than the five minutes allowed

Pre-Authentication Type in Events 4768 and 4771

Pre-Authentication Type says how the client proved itself, which separates a password sign-in from an armoured, certificate or unproved one. Both events record it in the Security log.

Value	Meaning
2	A password, proved with an encrypted timestamp (PA-ENC-TIMESTAMP)
138	An armoured sign-in (FAST), proved with an encrypted challenge
15 or 16	A certificate or smart card sign-in (PKINIT)
0	No pre-authentication, for an account that does not require it (event 4768 only)

What Is Logged

Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.

Event and Log	Written On	Switch It On	What It Tells You
4771 `Kerberos pre-authentication failed` (opens in a new tab) Security log	Domain controllers	Audit Kerberos Authentication Service	Failure Code 0x18 when the timestamp does not open with her key, which means a wrong password.On failure

Check It on a Machine

These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.

Advanced Audit Policy

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

Password Spraying
One guessed password tried against many accounts, over Kerberos and NTLM.
At This Step Each guess, account after account, is one of these requests. A wrong password logs 4771 in dc-01's Security log with Failure Code 0x18.
AS-REP Roasting
Asks for a TGT for an account that skips pre-authentication, then guesses offline.
At This Step This request normally proves the password. An account set not to need that proof is answered without it, so anyone can get its reply.
Overpass-the-Hash
Uses a stolen NT hash or AES key to get a real TGT, turning a hash into Kerberos.
At This Step The proof here is a timestamp sealed with the account's key, so a stolen NT hash (the RC4 key) or AES key makes it as the password would.
Skeleton Key
Patches LSASS on a DC so one master password signs in as any account.
At This Step A DC patched in memory also accepts this proof made from one master password, for any account, in RC4 where the account would use AES.
Certificate Services Abuse
Gets a certificate that signs in as another account, often a Domain Admin.
At This Step With certificate sign-in a certificate replaces this request's timestamp, so one wrongly issued in an admin's name signs in as that admin.
Shadow Credentials
A key added to an account lets a certificate sign in as it, past a password reset.
At This Step A certificate is the proof here, for an account that never uses one, so the event 4768 in dc-01's Security log shows certificate fields.
Delegated Managed Service Account Abuse
A superseded service account hands a new managed account its reach.
At This Step A sign-in as the dMSA logs a routine event 4768 in dc-01's Security log, so the lead is the 5136 that pointed it at a privileged account.