How to Enable Kerberos Event Logging (Windows)

Kerberos authentication issues on Windows can be frustrating to troubleshoot because the default logging level does not capture the detail you need to identify where a ticket request or renewal is failing. Enabling Kerberos event logging writes those events to the system log, giving you a clear trail of authentication activity on a specific machine.

Prerequisites

• You need local administrator access to the target Windows computer.
• You should have a clear reason to enable this logging, because it increases the volume of system log entries and can have a minor performance impact.

Enabling Kerberos Event Logging

1. Open Registry Editor (regedit) with elevated privileges.

2. Navigate to the following key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

   If the Parameters subkey does not exist, create it under Kerberos.

3. Create a new DWORD (32-bit) Value with the following settings:

   Setting	Value
   Name	LogLevel
   Type	REG_DWORD
   Data	0x1

4. Close Registry Editor.

When the Setting Takes Effect

On Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP, the change takes effect immediately. On Windows 2000, you must restart the computer for the setting to apply.

Viewing Kerberos Events

Once enabled, Kerberos-related events appear in the System log. Open Event Viewer (eventvwr.msc), expand Windows Logs, and select System. Filter by source Kerberos to isolate the relevant entries.

Disabling Kerberos Event Logging

When you are finished troubleshooting, remove the LogLevel registry value to stop the additional logging. Leaving it in place indefinitely increases system log volume and can slightly degrade performance.

Quick Reference

• Registry path: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
• Value name: LogLevel
• Type: REG_DWORD
• Data: 0x1
• Log location: System log, source Kerberos

• Security
• How-To

• Kerberos
• SysAdmin