ID de evento de Windows 4768: se solicitó un ticket de autenticación Kerberos

• The TGT is about to expire.
• The client is attempting to delegate credentials to a SPN that's not in its Allowed-to-delegate-to list.

• Smart card logon is being attempted and the proper certificate can't be located. This can happen because the wrong certificate authority (CA) is being queried or the proper CA can't be contacted.
• The DC doesn’t have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates).

This error code can't occur in event 4768, but it can occur in 4771.

Since the remote KDC may change its PKCROSS key while there are PKCROSS tickets still active, it should cache the old PKCROSS keys until the last issued PKCROSS ticket expires. Otherwise, the remote KDC will respond to a client with this error code.

See RFC1510 for more details.

The user’s password has expired.

This error code can't occur in event 4768, but it does occur in event 4771.

The wrong password was provided.

This error code can't occur in event 4768, but it does occur in event 4771.

Often occurs in UNIX interoperability scenarios. MIT-Kerberos clients do not request pre-authentication when they send a KRB_AS_REQ message. If pre-authentication is required (the default setting), Windows systems will send this error.

Most MIT-Kerberos clients will respond to this error by giving pre-authentication, in which case the error can be ignored.

The smaller the value for the Kerberos policy setting Maximum lifetime for user ticket, the more likely it is that this error will occur.

Because ticket renewal is automatic, you shouldn't have to do anything if you get this message.

The clocks on the KDC and the client aren't synchronized.

If cross-realm Kerberos authentication is being attempted, then you should verify time synchronization between the KDC in the target realm and the KDC in the client realm.

• The address of the computer sending the ticket is different from the valid address in the ticket. A possible cause of this could be an IP address change
• The ticket was passed through a proxy server or NAT. The client is unaware of the address scheme used by the proxy server, so unless the program caused the client to request a proxy server ticket with the proxy server's source address, the ticket could be invalid.

• The target server finds that the message format is wrong. This applies to KRB_AP_REQ, KRB_SAFE, KRB_PRIV, and KRB_CRED messages.
• UDP protocol is being attempted with user-to-user authentication.

• The authentication data was encrypted with the wrong key for the intended server.
• The authentication data was modified in transit by a hardware or software error, or by an attacker.
• Incorrect DNS data caused the client to send the request to the wrong server.

This event is generated by KRB_SAFE and KRB_PRIV messages if an incorrect sequence number is included, or if a sequence number is expected but not present.

See RFC4120 for more details.

This error might be generated on the server side during receipt of an invalid KRB_AP_REQ message. The server doesn't have the right key to decipher the ticket.

Because it's possible for the server to be registered in multiple realms with different keys in each realm, the realm field in the unencrypted portion of the ticket in the KRB_AP_REQ is used to specify which secret key the server should use to decrypt that ticket.

The size of a ticket is too large to be transmitted reliably via UDP.

In a Windows environment, this message is purely informational. A Windows computer will automatically try TCP if UDP fails.

• Group membership has overloaded the Privilege Account Certificate (PAC).
• Multiple recent password changes haven't been propagated.
• Crypto subsystem error caused by running out of memory.
• The SPN is too long
• The SPN has too many parts.

If a KDC that doesn’t understand how to interpret a set high bit of the length encoding receives a request with the high order bit of the length set, it must return a KRB-ERROR message with the error KRB_ERR_FIELD_TOOLONG, and it must close the TCP stream.

Each request (KRB_KDC_REQ) and response (KRB_KDC_REP or KRB_ERROR) sent over the TCP stream is preceded by the length of the request as 4 octets in network byte order. The high bit of the length is reserved for future expansion and must currently be set to zero.

The trustedCertifiers field contains a list of CAs trusted by the client, just in case the client doesn't possess the KDC's public key certificate. If the KDC has no certificate signed by any of the trustedCertifiers, then it returns this error code.

See RFC1510 for more details.

The client presents a cross-realm TGT to a realm other than the one specified in the TGT.

This error rarely occurs, but it’s typically caused by an incorrectly configured DNS.

Additional pre-authentication required (accompanied by KRB-ERROR from the KDC). Usually used to notify a client of which key to use for encryption while sending a PA-ENC-TIMESTAMP pre-authentication value.

Never seen in Microsoft Active Directory environments.

Used for smart card authentication.

Never seen in certain Active Directory environments.

Additional pre-authentication required (accompanied by KRB-ERROR from the KDC). Usually used to notify a client of which key to use for encryption while sending a PA-ENC-TIMESTAMP pre-authentication value.

Never seen in Microsoft Active Directory environments.