0

Ever since changing to Windows 11 we have some workstations that now and then try to connect via smart card, but we don't use smart cards.

The event occurs with the computer's account, not a user's account, which is also interesting.

Event ID: AUDIT_FAILURE(4771)
Domain: [Domain/Server]
SID: [sid]
Account Name: [computer account (not user account)]
Service Name: krbtgt/[domain]
Client Address: [ip]
Port: [port]
Ticket Options: 0x40810010
Failure Code: 0x10
Pre Auth Type: 16

Ticket Options: 0x40810010 - Forwardable, Renewable, Canonicalize, Renewable-ok

1
Forwardable
(TGT only). Tells the ticket-granting service that it can issue a new TGT—based on the presented TGT—with a different network address based on the presented TGT.

8
Renewable
Used in combination with the End Time and Renew Till fields to cause tickets with long life spans to be renewed at the KDC periodically.

15
Name-canonicalize
To request referrals, the Kerberos client MUST explicitly request the "canonicalize" KDC option for the AS-REQ or TGS-REQ.

27
Renewable-ok
The RENEWABLE-OK option indicates that a renewable ticket will be acceptable if a ticket with the requested life cannot otherwise be provided, in which case a renewable ticket may be issued with a renew-till equal to the requested end time. The value of the renew-till field may still be limited by local limits, or limits selected by the individual principal or server.

Failure Code: 0x10
KDC_ERR_PADATA_TYPE_NOSUPP
KDC has no support for PADATA type (pre-authentication data)
Smart card logon is being attempted and the proper certificate cannot be located. This problem can happen because the wrong certification authority (CA) is being queried or the proper CA cannot be contacted in order to get Domain Controller or Domain Controller Authentication certificates for the domain controller. It can also happen when a domain controller doesn't have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates).

Pre Auth Type: 16
PA-PK-AS-REQ
Request sent to KDC in Smart Card authentication scenarios.

I would like to get it to stop, but I have been having difficulty nailing it down. Wanted to see if anyone else has run into something similar and found a solution.

1 Answer 1

0

Maybe Disable in Group Policy Editor

Computer Configuration > Administrative Templates > Windows Components > Smart Card

1
  • Yeah, I was looking into that, thanks
    – Karbashi
    Apr 11, 2023 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .