I have an average of 17-18 failure audit events per hour recorded in the Security event log of a Windows 2012R2 domain controller, related to attempts of a Windows 2008R2 member server to obtain a Kerberos service ticket
A Kerberos service ticket was requested.
Account Information:
Account Name: TORPDC01$@ACME.COM
Account Domain: ACME.COM
Logon GUID: {00000000-0000-0000-0000-000000000000}
Service Information:
Service Name: krbtgt/ACME.COM
Service ID: S-1-0-0
Network Information:
Client Address: ::ffff:192.168.1.15
Client Port: 28904
Additional Information:
Ticket Options: 0x60810010
Ticket Encryption Type: 0xFFFFFFFF
Failure Code: 0xE
Transited Services: -
This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120.
The failure code 0xE indicates an unsupported authentication type. I have monitored the traffic between the servers with Wireshark and I see that the Windows 2008R2 server is making a request towards the domain controller to start a session using the encryption type aes256-cts-hmac-sha1-96. This request is rejected with an "encryption type not supported" error code and the audit failure is recorded in the event log. The Windows 2008 server then sends a list of 5 encryption types and from it the domain controller responds with the selected type: ARCFOUR-HMAC-MD5. After that, the traffic continues normally, and I'm assuming that the 2 servers are using the encryption parameters they agreed upon. There is no other problem that I can see between the 2 servers. Any suggestions on how to get rid of those events? Is it just a matter of audit policy? Maybe I can force the Windows 2008R2 server to start its requests with a different set of encryption protocols parameters?