Details of the event with ID 40 of the source Microsoft-Windows-Kerberos-Key-Distribution-Center

Author Uwe Gradenegger Posted on Categories Certificate usage, Active Directory, Events Tags Event Viewer
Event Source:Microsoft-Windows-Kerberos-Key-Distribution-Center
Event ID:40 (0x80000028)
Event log:System
Event type:Warning or error
Event text (English):The Key Distribution Center (KDC) encountered a user certificate that was valid but could not be mapped to a user in a secure way (such as via explicit mapping, key trust mapping, or a SID). The certificate also predated the user it mapped to, so it was rejected. See https://go.microsoft.com/fwlink/?linkid=2189925 to learn more. User: %1 Certificate Subject: %2 Certificate Issuer: %3 Certificate Serial Number: %4 Certificate Thumbprint: %5 Certificate Issuance Time: %6 Account Creation Time: %7
Event text (German):Der Schlüsselverteilungscenter (KDC) hat ein gültiges Benutzerzertifikat gefunden, das jedoch keinem Benutzer auf sichere Weise zugeordnet werden konnte (z. B. über eine explizite Zuordnung, eine Schlüsselvertrauenszuordnung oder eine SID). Das Zertifikat hat auch dem Benutzer vorangestellt, dem es zugeordnet ist, weshalb es abgelehnt wurde. Weitere Informationen finden Sie unter https://go.microsoft.com/fwlink/?linkid=2189925 . Benutzer: %1 Zertifikatantragsteller: %2 Zertifikataussteller: %3 Zertifikatseriennummer: %4 Zertifikatfingerabdruck: %5 Zertifikatausstellungszeit: %6 Erstellungszeit des Kontos: %7

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

Parameter

The parameters contained in the event text are filled with the following fields:

  • %1: AccountName (win:UnicodeString)
  • %2: Subject (win:UnicodeString)
  • %3: Issuer (win:UnicodeString)
  • %4: SerialNumber (win:UnicodeString)
  • %5: Thumbprint (win:UnicodeString)
  • %6: IssuanceTime (win:UnicodeString)
  • %7: AccountCreationTime (win:UnicodeString)
  • %8: __binLength (win:UInt32)
  • %9: binary (win:Binary)

Description

No description has been written for this yet.

Security assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

An alert should definitely be triggered for this event, since certificates are not accepted when it is logged. This can indicate an attack, but also a misconfiguration with an effect on availability.

External sources