event.code 4771 and 4768 status 0x6

Hello Machado,

The distinction between event 4768 and 4771 lies in the stage of the Kerberos authentication process where the failure occurs. Event 4768 is logged when a client requests a Ticket Granting Ticket (TGT) from the KDC (AS-REQ). Event 4771 is logged when the KDC validates the pre-authentication data provided by the client.

Status code 0x6 translates to KDC_ERR_C_PRINCIPAL_UNKNOWN, meaning the KDC cannot locate the client principal in Active Directory. When you see this code in event 4768, it indicates the failure happened at the initial AS-REQ stage - the KDC couldn’t find the account at all. Event 4771 with 0x6 would only occur if the request had passed into the pre-authentication validation stage but then failed because the principal was invalid. In practice, most test scenarios where you deliberately use a non-existent account will stop at 4768, because the KDC rejects the request before pre-authentication is even processed.

That’s why you’re consistently seeing 4768 with 0x6 instead of 4771. To trigger 4771 with 0x6, you’d need a situation where the client sends pre-authentication data for a principal name that exists in some form but is invalid in the KDC’s lookup context. For example, if the account was deleted but cached credentials were still attempted, or if there’s a mismatch in realm/domain suffix causing the KDC to accept the AS-REQ but fail during pre-auth validation. In clean test environments, the KDC usually short-circuits earlier, so you won’t see 4771 unless you replicate those edge conditions.

In short:

• Event 4768 + 0x6 = principal not found at AS-REQ stage.
• Event 4771 + 0x6 = principal not found during pre-auth validation, which is rarer and requires a slightly different failure path.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!HP.