Home
  •  

Invalid Forwarded AS Request

Invalid_Forwarded_AS_Request_5_Rule (Rule)

Knowledge Base article:

Summary

This domain controller has received an invalid Authentication Service (AS) request from the primary domain controller (PDC). It is possible that someone is attempting to spoof the PDC for the domain.

Resolutions

Verify that this domain controller can communicate with the PDC by reviewing the alerts created by the AD Op Master Response script.

Verify that there is no firewall blocking the Kerberos port.

Reset the password on the machine account for the PDC.

Use Adsiedit.msc to verify that the PDC machine account does not have a user principal name (UPN) defined.

External

For more information, see:

Element properties:

TargetMicrosoft.Windows.Server.2012.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Event_ID15
Event SourceMicrosoft-Windows-Kerberos-Key-Distribution-Center
Alert GenerateFalse
RemotableTrue
Event LogSystem
CommentMom2005ID='{D4C4FF8B-7908-4506-B36B-952B824E6533}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Invalid_Forwarded_AS_Request_5_Rule" Comment="Mom2005ID='{D4C4FF8B-7908-4506-B36B-952B824E6533}';MOM2005GroupID=" Enabled="true" Target="AD2012Core!Microsoft.Windows.Server.2012.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>15</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft-Windows-Kerberos-Key-Distribution-Center</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>