Only User failed to authenticate through Kerberos logon events are audited and returned in a search (4300334)

Chat now with support

Zurück

Feedback übermittelt

Konnten Sie mithilfe dieses Artikels ein Problem lösen?

Bewertung auswählen

Titel

Only User failed to authenticate through Kerberos logon events are audited and returned in a search
Beschreibung

When searching for logon activity only 'User failed to authenticate through Kerberos' events are visible.
There are not any successful 'User authentications through Kerberos' events being audited.
Checking the ‘Audit Logon events’ audit policy for all servers and workstations, the policy is set for Success.
Ursache

The User authenticated through Kerberos event class is disabled by default .
Lösung
Perform the following steps to enable this event class:
1. Open the Client | Administrative Tasks tab | Select Auditing in the lower left corner | Select Audit Events at the top of the left hand panel.
2. Locate the "User authenticated through kerberos" event in the list
3. To enable, click the drop-arrow next to "Disabled" and change the Status to "Enabled".

Feedback übermittelt

Konnten Sie mithilfe dieses Artikels ein Problem lösen?

Bewertung auswählen

Empfohlener Inhalt

Titel