CCE-38140-0Platform: win2012r2 | Date: (C)2015-10-08 (M)2022-10-10 |
Audit Policy: Account Logon: Kerberos Authentication Service
This subcategory reports events generated by the Kerberos Authentication Server. These events occur on the computer that is authoritative for the credentials. Events for this subcategory include:
? 4768: A Kerberos authentication ticket (TGT) was requested.
? 4771: Kerberos pre-authentication failed.
? 4772: A Kerberos authentication ticket request failed.
Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226.
Parameter:
Technical Mechanism:
(1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon!Audit Policy: Account Logon: Kerberos Authentication Service
(2) WMI: ###
CCSS Severity: | CCSS Metrics: |
CCSS Score : | Attack Vector: |
Exploit Score: | Attack Complexity: |
Impact Score: | Privileges Required: |
Severity: | User Interaction: |
Vector: | Scope: |
| Confidentiality: |
| Integrity: |
| Availability: |
| |
References: