Home
  •  

PAC Verification Failure

PAC_Verification_Failure_5_Rule (Rule)

Knowledge Base article:

Summary

Kerberos failed to verify the signature on the Privilege Attribute Certificate (PAC) field in the Kerberos ticket from the Key Distribution Center (KDC). This indicates that the PAC field was modified.

This is significant because the PAC field is used to store the user’s token. It is possible that someone is attempting to break into your system.

In rare circumstances, it is possible that a memory problem on a router corrupted the packet during transmission.

Resolutions

Verify that the ticket-granting service (TGS) reply packet originated from the KDC. If it did not, investigate a possible attempt to break in to your system.

If the packet did originate from the KDC, reset the machine account password for the KDC.

External

For more information, see:

Element properties:

TargetMicrosoft.Windows.Server.2012.R2.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Event_ID18
Event SourceMicrosoft-Windows-Kerberos-Key-Distribution-Center
Alert GenerateFalse
RemotableTrue
Event LogSystem
CommentMom2005ID='{7EC0084F-6BD7-4346-AAD3-C2BFDB994343}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="PAC_Verification_Failure_5_Rule" Comment="Mom2005ID='{7EC0084F-6BD7-4346-AAD3-C2BFDB994343}';MOM2005GroupID=" Enabled="true" Target="AD2012R2Core!Microsoft.Windows.Server.2012.R2.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>18</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft-Windows-Kerberos-Key-Distribution-Center</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>