Share via

Windows Troublshooting: Event ID 4771 and 4768 - Audit Failure

  • Article

Introduction :

We will try to explain this with simple words. But before, let's check the image bellow:

In the first picture, Event Id 4768, we will get the IP and account that are causing the audit failure;

After, you check in Event ID 4771 and scroll down to check more information about failure. The failure is talking about certificate that is used for pre-authentication.

Root Cause :

This occur because the user (account above) have changed the password and forgot the session (in that IP) opened, but disconnected.

Going to that IP, we will check the follow:

Solution:

Look that the user is disconnected. So, do the users' logoff and check the event viewer again.

Hope this can help you!

Enjoy!