Kerberos: The Definitive Guide

Windows domain controllers

As we discussed earlier, the log files for the two different audit options (logon auditing and account logon auditing) are stored on different machines’ Event Logs. The account logon auditing produces audit logs that are similar to the other KDC implementations we’ve covered. Since the account logon auditing is generated by the Kerberos KDC service running on the domain controllers, we’re going to examine what those logs look like.

There are several Kerberos-related log events that account logon auditing emits. They are listed below:

• 672 Authentication Ticket Granted

• 673 Service Ticket Granted

• 674 Ticket Granted Renewed

• 675 Pre-authentication Failed

• 676 Authentication Ticket Request Failed

• 677 Service Ticket Request Failed

Any Kerberos client looks the same from the perspective of account logon auditing. It doesn’t matter whether the requesting machine is running Windows or Unix; as long as it contacts the KDC running on one of your domain controllers, the KDC service will log both the successful and failed attempts at requesting tickets. So, let’s dive in and examine some sample event logs.

Here’s an example of a Windows machine successfully authenticating a user “jgarman” in the WEDGIE.ORG realm:

Event Type: Success Audit Event Source: Security Event Category: Account Logon Event ID: 672 Date: 10/1/2002 Time: 11:55:10 PM User: NT AUTHORITY\SYSTEM Computer: DESKTOP Description: Authentication Ticket Granted: User Name: jgarman Supplied Realm Name: WEDGIE.ORG User ...