From 34c16a971936e362ccf8916576b72354a3eebff1 Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Mon, 20 Mar 2023 15:49:46 +0100 Subject: [PATCH 1/4] Update event-4769.md Add details to some of the error logging details... --- windows/security/threat-protection/auditing/event-4769.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index e82434467c..d15a58aca9 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -194,7 +194,12 @@ The most common values: | 0x18 | RC4-HMAC-EXP | Default suite for operating systems before Windows Server 2008 and Windows Vista. | | 0xFFFFFFFF or 0xffffffff | - | This type shows in Audit Failure events. | -- **Failure Code** \[Type = HexInt32\]**:** hexadecimal result code of TGS issue operation. The table below contains the list of the most common error codes for this event: +- **Failure Code** \[Type = HexInt32\]**:** hexadecimal result code of TGS issue operation. +Some errors are only reported when you set KdcExtraLogLevel per [Kerberos and KDC registry entries] (https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys) hexadecimal flag, OR-connected for multiple flags being set: +0x01: Audit SPN unknown errors. +0x10: Log audit events on encryption type (ETYPE) and bad options errors. + +The table below contains the list of the most common error codes for this event: | Code | Code Name | Description | Possible causes | |------|----------------------------------------|-----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| From 47a7c7eaafc683ac1e3ebcf834dc6cadba1ea241 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 20 Mar 2023 11:07:57 -0400 Subject: [PATCH 2/4] Update windows/security/threat-protection/auditing/event-4769.md --- windows/security/threat-protection/auditing/event-4769.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index d15a58aca9..ad744c30a8 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -195,7 +195,7 @@ The most common values: | 0xFFFFFFFF or 0xffffffff | - | This type shows in Audit Failure events. | - **Failure Code** \[Type = HexInt32\]**:** hexadecimal result code of TGS issue operation. -Some errors are only reported when you set KdcExtraLogLevel per [Kerberos and KDC registry entries] (https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys) hexadecimal flag, OR-connected for multiple flags being set: +Some errors are only reported when you set [KdcExtraLogLevel](/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys) registry key value with the following flags: 0x01: Audit SPN unknown errors. 0x10: Log audit events on encryption type (ETYPE) and bad options errors. From c1053033ecea65d5d606c7daee8901005a361b80 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 20 Mar 2023 11:08:04 -0400 Subject: [PATCH 3/4] Update windows/security/threat-protection/auditing/event-4769.md --- windows/security/threat-protection/auditing/event-4769.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index ad744c30a8..f51f9708f8 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -196,7 +196,7 @@ The most common values: - **Failure Code** \[Type = HexInt32\]**:** hexadecimal result code of TGS issue operation. Some errors are only reported when you set [KdcExtraLogLevel](/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys) registry key value with the following flags: -0x01: Audit SPN unknown errors. +- 0x01: Audit SPN unknown errors. 0x10: Log audit events on encryption type (ETYPE) and bad options errors. The table below contains the list of the most common error codes for this event: From 0c3889419f44154ef6d7fb813d5bd12861265ba9 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 20 Mar 2023 11:08:10 -0400 Subject: [PATCH 4/4] Update windows/security/threat-protection/auditing/event-4769.md --- windows/security/threat-protection/auditing/event-4769.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index f51f9708f8..98746150c6 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -197,7 +197,7 @@ The most common values: - **Failure Code** \[Type = HexInt32\]**:** hexadecimal result code of TGS issue operation. Some errors are only reported when you set [KdcExtraLogLevel](/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys) registry key value with the following flags: - 0x01: Audit SPN unknown errors. -0x10: Log audit events on encryption type (ETYPE) and bad options errors. +- 0x10: Log audit events on encryption type (ETYPE) and bad options errors. The table below contains the list of the most common error codes for this event: