Event ID 4771: Kerberos Pre-Authentication Failed

# Query Event ID 4771 on Domain Controllers
# Run this on DC or specify -ComputerName

$dcName = (Get-ADDomainController).Name
$startTime = (Get-Date).AddHours(-24)

$kerbFailures = Get-WinEvent -ComputerName $dcName -FilterHashtable @{
    LogName = 'Security'
    Id = 4771
    StartTime = $startTime
} -ErrorAction SilentlyContinue

Write-Host "=== Kerberos Pre-Auth Failures (Last 24 Hours) ==="24 Hours) ===" -ForegroundColor Cyan
Write-Host "Total failures: $($kerbFailures.Count)"

# Group by failure code
Write-Host "`n=== Failures by Error Code ===" -ForegroundColor Yellow
$kerbFailures | ForEach-Object {
    $xml = [xml]$_.ToXml()
    ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'FailureCode'}).'#text'
} | Group-Object | Select-Object @{N='FailureCode';E={$_.Name}},
    @{N='Description';E={
        switch ($_.Name) {
            '0x6' {'Client not found in database'}
            '0x12' {'Account disabled'}
            '0x17' {'Password expired'}
            '0x18' {'Pre-auth failed (wrong password)'}
            '0x25' {'Clock skew too great'}
            default {'Unknown'}
        }
    }}, Count | Format-Table -AutoSize

# Group by account name
Write-Host "`n=== Failures by Account ===" -ForegroundColor Yellow
$kerbFailures | ForEach-Object {
    $xml = [xml]$_.ToXml()
    ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
} | Group-Object | Sort-Object Count -Descending | Select-Object Name, Count -First 15 |
    Format-Table -AutoSize

# Check AD account status for affected user/service
$accountName = "john.doe"

$account = Get-ADUser -Identity $accountName -Properties *

Write-Host "=== Account Status for $accountName ===" -ForegroundColor Cyan

[PSCustomObject]@{
    'Display Name' = $account.DisplayName
    'UPN' = $account.UserPrincipalName
    'Enabled' = $account.Enabled
    'Locked Out' = $account.LockedOut
    'Lockout Time' = $account.AccountLockoutTime
    'Bad Password Count' = $account.badPwdCount
    'Password Last Set' = $account.PasswordLastSet
    'Password Expired' = $account.PasswordExpired
    'Password Never Expires' = $account.PasswordNeverExpires
    'Account Expires' = $account.AccountExpirationDate
    'Last Logon' = $account.LastLogonDate
} | Format-List

# Check effective password policy
Get-ADUserResultantPasswordPolicy -Identity $accountName |
    Select-Object Name, MaxPasswordAge, MinPasswordLength, LockoutThreshold | Format-List

# Check if account is a service account with issues
if ($account.ServicePrincipalNames) {
    Write-Host "`n=== Service Principal Names ===" -ForegroundColor Yellow
    $account.ServicePrincipalNames | ForEach-Object { Write-Host "  $_" }
}

# Check time synchronization status

# On Exchange server
Write-Host "=== Local Time Status ===" -ForegroundColor Cyan
w32tm /query /status

# Check time against DC
Write-Host "`n=== Time Source Configuration ===" -ForegroundColor Yellow
w32tm /query /configuration

# Check time offset
Write-Host "`n=== Time Offset from Source ===" -ForegroundColor Yellow
w32tm /stripchart /computer:$(Get-ADDomainController).HostName /samples:3 /dataonly

# Check all Exchange servers' time
$exchangeServers = Get-ExchangeServer | Select-Object -ExpandProperty Name

Write-Host "`n=== Exchange Server Time Comparison ===" -ForegroundColor Cyan
foreach ($server in $exchangeServers) {
    try {
        $remoteTime = Invoke-Command -ComputerName $server -ScriptBlock { Get-Date } -ErrorAction Stop
        $localTime = Get-Date
        $offset = ($remoteTime - $localTime).TotalSeconds

        $color = if ([Math]::Abs($offset) -lt 60) {"Green"} elseif ([Math]::Abs($offset) -lt 300) {"Yellow"} else {"Red"}
        Write-Host "$server : Offset = $([math]::Round($offset,1)) seconds"$offset,1)) seconds" -ForegroundColor $color
    } catch {
        Write-Host "$server : Unable to check - $_"$_" -ForegroundColor Red
    }
}

# Kerberos max clock skew is 5 minutes (300 seconds) by default300 seconds) by default
Write-Host "`nNote: Kerberos max clock skew is 5 minutes (300 seconds)"300 seconds)" -ForegroundColor Cyan

# Check Exchange server SPNs
$exchangeServer = $env:COMPUTERNAME

Write-Host "=== SPNs for Exchange Server $exchangeServer ===" -ForegroundColor Cyan

# Get computer account SPNs
$computerSPNs = Get-ADComputer -Identity $exchangeServer -Properties ServicePrincipalNames |
    Select-Object -ExpandProperty ServicePrincipalNames

$computerSPNs | Where-Object {$_ -match "exchange|http|smtp"} | Sort-Object

# Check for duplicate SPNs (causes Kerberos failures)
Write-Host "`n=== Checking for Duplicate SPNs ===" -ForegroundColor Yellow
setspn -X

# Common Exchange SPNs that should exist:
Write-Host "`n=== Expected Exchange SPNs ===" -ForegroundColor Cyan
@(
    "HTTP/$exchangeServer",
    "HTTP/$exchangeServer.domain.com",
    "exchangeRFR/$exchangeServer",
    "exchangeRFR/$exchangeServer.domain.com",
    "exchangeAB/$exchangeServer",
    "exchangeAB/$exchangeServer.domain.com",
    "exchangeMDB/$exchangeServer",
    "exchangeMDB/$exchangeServer.domain.com"
) | ForEach-Object { Write-Host "  $_" }

# Verify specific SPN exists
$checkSPN = "HTTP/mail.domain.com"
$result = setspn -Q $checkSPN
if ($result -match "No such SPN found") {
    Write-Host "`nWARNING: SPN '$checkSPN' not found" -ForegroundColor Red
} else {
    Write-Host "`nSPN '$checkSPN' found:" -ForegroundColor Green
    $result
}

# Identify services using the affected account
$serviceAccount = "CONTOSOsvc_exchange"

# Check Windows services
Write-Host "=== Windows Services Using Account ===" -ForegroundColor Cyan
Get-WmiObject Win32_Service | Where-Object {$_.StartName -match $serviceAccount.Split('')[1]} |
    Select-Object Name, State, StartMode | Format-Table -AutoSize

# Check scheduled tasks
Write-Host "`n=== Scheduled Tasks Using Account ===" -ForegroundColor Yellow
Get-ScheduledTask | ForEach-Object {
    $principal = $_.Principal
    if ($principal.UserId -match $serviceAccount.Split('')[1]) {
        [PSCustomObject]@{
            TaskName = $_.TaskName
            TaskPath = $_.TaskPath
            RunAs = $principal.UserId
            State = $_.State
        }
    }
} | Format-Table -AutoSize

# Check IIS App Pools
Import-Module WebAdministration -ErrorAction SilentlyContinue
Get-ChildItem IIS:AppPools | ForEach-Object {
    $identity = $_.processModel.userName
    if ($identity -match $serviceAccount.Split('')[1]) {
        Write-Host "App Pool: $($_.Name) - Identity: $identity"$identity"
    }
}

# Update service account password everywhere
$newPassword = Read-Host "Enter new password for $serviceAccount" -AsSecureString

# Update AD account
Set-ADAccountPassword -Identity ($serviceAccount.Split('')[1]) -NewPassword $newPassword -Reset

# Update Windows services (example)
# sc.exe config "ServiceName" obj= "$serviceAccount" password= "password""$serviceAccount" password= "password"

Write-Host "`n=== Post-Update Actions ===" -ForegroundColor Cyan
Write-Host "1. Restart affected services"
Write-Host "2. Recycle affected IIS app pools"
Write-Host "3. Update scheduled tasks with new password"
Write-Host "4. Update any application configuration files"

# Configure proper time hierarchy:
# External NTP -> PDC Emulator -> Other DCs -> Domain Members

# Step 1: Configure PDC Emulator to sync with external source
$pdcEmulator = (Get-ADDomain).PDCEmulator
Write-Host "PDC Emulator: $pdcEmulator" -ForegroundColor Cyan

# On PDC Emulator, run:
# w32tm /config /manualpeerlist:"time.windows.com,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update
# Restart-Service w32time
# w32tm /resync

# Step 2: Other DCs should sync from domain hierarchy
# w32tm /config /syncfromflags:domhier /update
# Restart-Service w32time

# Step 3: Verify time config on Exchange servers
Write-Host "`n=== Exchange Server Time Configuration ===" -ForegroundColor Yellow
$exchangeServers = Get-ExchangeServer | Select-Object -ExpandProperty Name

foreach ($server in $exchangeServers) {
    Write-Host "`n--- $server ---"
    Invoke-Command -ComputerName $server -ScriptBlock {
        w32tm /query /status | Select-String "Source|Stratum|Last Successful"
    } -ErrorAction SilentlyContinue
}

# Step 4: Force immediate sync on all Exchange servers
foreach ($server in $exchangeServers) {
    Write-Host "Syncing time on $server..."
    Invoke-Command -ComputerName $server -ScriptBlock {
        w32tm /resync /force
    } -ErrorAction SilentlyContinue
}

# Step 5: Verify sync after fix
Start-Sleep -Seconds 10
Write-Host "`n=== Time Verification ===" -ForegroundColor Green
foreach ($server in $exchangeServers) {
    $remoteTime = Invoke-Command -ComputerName $server -ScriptBlock { Get-Date }
    $offset = ($remoteTime - (Get-Date)).TotalSeconds
    Write-Host "$server : Offset = $([math]::Round($offset,1)) seconds"$offset,1)) seconds"
}

# Check and fix Exchange SPNs

# Step 1: Find duplicate SPNs (major issue)
Write-Host "=== Checking for Duplicate SPNs ===" -ForegroundColor Yellow
setspn -X

# Step 2: Check SPNs for Exchange server
$exchangeServer = $env:COMPUTERNAME
$serverFQDN = [System.Net.Dns]::GetHostByName($exchangeServer).HostName

Write-Host "`n=== Current SPNs on $exchangeServer ===" -ForegroundColor Cyan
setspn -L $exchangeServer

# Step 3: Add missing Exchange SPNs
$requiredSPNs = @(
    "HTTP/$exchangeServer",
    "HTTP/$serverFQDN",
    "exchangeRFR/$exchangeServer",
    "exchangeRFR/$serverFQDN",
    "exchangeAB/$exchangeServer",
    "exchangeAB/$serverFQDN",
    "exchangeMDB/$exchangeServer",
    "exchangeMDB/$serverFQDN"
)

foreach ($spn in $requiredSPNs) {
    $check = setspn -Q $spn
    if ($check -match "No such SPN found") {
        Write-Host "Missing SPN: $spn - Adding..." -ForegroundColor Yellow
        # Uncomment to add:
        # setspn -S $spn $exchangeServer$spn $exchangeServer
    } else {
        Write-Host "SPN exists: $spn" -ForegroundColor Green
    }
}

# Step 4: If you have a load balancer or CAS array name
$loadBalancerName = "mail.domain.com"
Write-Host "`n=== Checking Load Balancer SPNs ===" -ForegroundColor Cyan

# HTTP SPN for load balancer - should be on service account or specific server
setspn -Q "HTTP/$loadBalancerName"

# Step 5: Fix Autodiscover SPN if using internal hostname
$autodiscoverName = "autodiscover.domain.com"
setspn -Q "HTTP/$autodiscoverName"

Write-Host "`n=== SPN Best Practices ===" -ForegroundColor Cyan
Write-Host "1. Each SPN should exist on only ONE account"
Write-Host "2. Use setspn -S (not -A) to prevent duplicates"-S (not -A) to prevent duplicates"
Write-Host "3. For load balanced names, use a service account"
Write-Host "4. Document all custom SPN configurations"

# Group Managed Service Accounts (gMSA) automatically manage passwords

# Step 1: Create KDS root key (if not exists) - only needed once per forest
# For production (wait 10 hours for replication):
# Add-KdsRootKey -EffectiveImmediately-EffectiveImmediately
# For testing only:
# Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))-EffectiveTime ((Get-Date).AddHours(-10))

# Step 2: Create the gMSA account
$gMSAName = "gMSA_Exchange"
$dnsHostName = "$gMSAName.contoso.com"
$exchangeServers = Get-ExchangeServer | Select-Object -ExpandProperty Name

# Get Exchange servers as computer objects
$principals = Get-ADComputer -Filter {Name -like "EXCH*"}

New-ADServiceAccount -Name $gMSAName -DNSHostName $dnsHostName -PrincipalsAllowedToRetrieveManagedPassword $principals -ServicePrincipalNames "HTTP/mail.contoso.com","HTTP/autodiscover.contoso.com"

# Step 3: Install gMSA on Exchange servers
foreach ($server in $exchangeServers) {
    Invoke-Command -ComputerName $server -ScriptBlock {
        param($name)
        Install-ADServiceAccount -Identity $name
        Test-ADServiceAccount -Identity $name
    } -ArgumentList $gMSAName
}

# Step 4: Configure service to use gMSA
# In Services.msc, set service account to: CONTOSOgMSA_Exchange$
# Password field should be left BLANK (gMSA manages it automatically)

# Step 5: Verify gMSA is working
Get-ADServiceAccount -Identity $gMSAName -Properties * |
    Select-Object Name, DNSHostName, PrincipalsAllowedToRetrieveManagedPassword,
    ServicePrincipalNames, PasswordLastSet | Format-List

Write-Host "`n=== gMSA Benefits ===" -ForegroundColor Cyan
Write-Host "1. Password automatically managed by AD"
Write-Host "2. Password changes automatically (120 days by default)"120 days by default)"
Write-Host "3. No password storage or rotation needed"
Write-Host "4. No Kerberos failures from expired service passwords"