4824 Security log · Kerberos Authentication Service medium severity low volume

Windows Event ID 4824 — An attempt to use DES encryption for Kerberos failed

DES Kerberos authentication attempted but failed (DES disabled).

Why event 4824 matters

DES is a legacy encryption type disabled in modern AD. Attempts to use DES may indicate very old legacy systems or attack tools using downgraded encryption.

How to detect it

Alert: any DES Kerberos attempts from modern systems.

Log source
Security
Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Steal or Forge Kerberos Tickets (T1558)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4824   // An attempt to use DES encryption for Kerberos failed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4824
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An attempt to use DES encryption for Kerberos failed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4824 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Kerberos Authentication Service events

4768 A Kerberos authentication ticket (TGT) was requested 4769 A Kerberos service ticket was requested 4770 A Kerberos service ticket was renewed 4771 Kerberos pre-authentication failed 4772 A Kerberos authentication ticket request failed 4773 A Kerberos service ticket request failed 4774 An account was mapped for logon 4775 An account could not be mapped for logon 4776 The domain controller attempted to validate the credentials for an account (NTLM) 4777 The domain controller failed to validate the credentials for an account 4820 A Kerberos Ticket-Granting-Ticket (TGT) was denied because the device does not meet the access control restrictions 4821 A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions

Frequently asked questions

What is Windows Event ID 4824?

An attempt to use DES encryption for Kerberos failed. DES Kerberos authentication attempted but failed (DES disabled).

Which log records event 4824?

Event 4824 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4824?

Event 4824 is associated with: Steal or Forge Kerberos Tickets (T1558).

How do you detect activity around event 4824?

Alert: any DES Kerberos attempts from modern systems.