4775 Security log · Kerberos Authentication Service low severity low volume

Windows Event ID 4775 — An account could not be mapped for logon

An account could not be mapped for logon by the specified package.

Why event 4775 matters

Authentication configuration issues. Rarely attack-related.

How to detect it

Investigate if clustered around specific accounts or systems.

Log source
Security
Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4775   // An account could not be mapped for logon
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4775
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An account could not be mapped for logon — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4775 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Kerberos Authentication Service events

4768 A Kerberos authentication ticket (TGT) was requested 4769 A Kerberos service ticket was requested 4770 A Kerberos service ticket was renewed 4771 Kerberos pre-authentication failed 4772 A Kerberos authentication ticket request failed 4773 A Kerberos service ticket request failed 4774 An account was mapped for logon 4776 The domain controller attempted to validate the credentials for an account (NTLM) 4777 The domain controller failed to validate the credentials for an account 4820 A Kerberos Ticket-Granting-Ticket (TGT) was denied because the device does not meet the access control restrictions 4821 A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions 4822 NTLM authentication failed because the account was a member of the Protected Users group

Frequently asked questions

What is Windows Event ID 4775?

An account could not be mapped for logon. An account could not be mapped for logon by the specified package.

Which log records event 4775?

Event 4775 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).

How do you detect activity around event 4775?

Investigate if clustered around specific accounts or systems.