Windows Event ID 4112 – Kerberos: Kerberos Authentication Service (AS) Started

Start by examining the complete event details to understand the Kerberos service startup context.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4112 using the filter option
4. Double-click the most recent 4112 event to view details
5. Review the General tab for realm information and encryption types
6. Check the Details tab for additional Kerberos configuration data

Look for the realm name (should match your domain), supported encryption algorithms, and any error codes. Normal events show successful initialization with multiple encryption types available.

Use PowerShell to retrieve and analyze Kerberos AS startup events across multiple domain controllers.

# Get recent Event ID 4112 entries
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4112} -MaxEvents 10

# Get detailed event information
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4112} -MaxEvents 5 | Format-List TimeCreated, Id, LevelDisplayName, Message

# Check for events in the last 24 hours
$StartTime = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4112; StartTime=$StartTime}

# Query multiple DCs (replace with your DC names)
$DCs = @('DC01', 'DC02', 'DC03')
foreach ($DC in $DCs) {
    Write-Host "Checking $DC..."
    Invoke-Command -ComputerName $DC -ScriptBlock {
        Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4112} -MaxEvents 1 -ErrorAction SilentlyContinue
    }
}

This approach helps identify patterns in Kerberos service startups and compare timing across domain controllers.

Confirm the Kerberos Key Distribution Center service is running properly after seeing Event 4112.

# Check KDC service status
Get-Service -Name 'KDC' | Format-List Name, Status, StartType

# Verify service dependencies
Get-Service -Name 'KDC' -DependentServices
Get-Service -Name 'KDC' -RequiredServices

# Check service startup type and account
Get-WmiObject -Class Win32_Service -Filter "Name='KDC'" | Select Name, StartMode, StartName, State

# Review recent service events
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} | Where-Object {$_.Message -like '*KDC*'} | Select TimeCreated, Id, LevelDisplayName, Message

Additionally, verify the service is listening on the correct ports:

# Check Kerberos ports (88 TCP/UDP, 464 TCP/UDP)
netstat -an | findstr :88
netstat -an | findstr :464

Review the domain's Kerberos configuration to ensure proper setup that corresponds with Event 4112 details.

# Check domain Kerberos policy settings
Get-ADDefaultDomainPasswordPolicy | Select KerberosEncryptionType, MaxPasswordAge, MinPasswordAge

# Review Kerberos-related Group Policy settings
Get-GPOReport -All -ReportType Html -Path C:\Temp\GPOReport.html

# Check domain functional level (affects Kerberos features)
Get-ADDomain | Select DomainMode, Forest
Get-ADForest | Select ForestMode

# Verify SPN registration for domain controllers
setspn -L $env:COMPUTERNAME

# Check for duplicate SPNs that could cause Kerberos issues
setspn -X

Review registry settings for Kerberos configuration:

# Check Kerberos registry settings
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters' -ErrorAction SilentlyContinue

Examine the HKLM\SYSTEM\CurrentControlSet\Services\KDC registry key for service configuration and startup parameters.

Implement comprehensive monitoring to track Kerberos service health beyond just startup events.

# Create a monitoring script for Kerberos events
$Events = @(4112, 4768, 4769, 4771, 4625)
foreach ($EventID in $Events) {
    $Count = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$EventID; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue).Count
    Write-Host "Event $EventID in last hour: $Count"
}

# Monitor authentication performance
Get-Counter -Counter '\Kerberos v5 AS Requests/sec', '\Kerberos v5 TGS Requests/sec' -SampleInterval 5 -MaxSamples 12

# Check for Kerberos errors
Get-WinEvent -FilterHashtable @{LogName='Security'; Level=2,3; StartTime=(Get-Date).AddDays(-1)} | Where-Object {$_.Message -like '*Kerberos*'}

Set up automated monitoring using Windows Task Scheduler or System Center Operations Manager to alert on missing 4112 events during expected startup times. Create a baseline of normal Kerberos service restart patterns to identify anomalies.