After applying the latest Microsoft Windows updates, Change Auditor no longer captures the following events:
"User failed to authenticate through Kerberos"
"User authenticated through Kerberos" if it has been enabled (This event is disabled by default)
Prior to applying the Windows updates, the Kerberos authentication events were being captured by CA.
You need to be signed in and under a current maintenance contract to view premium knowledge articles.