[Samba] [SamLogon, network] vs [Kerberos KDC, ENC-TS Pre-authentication]

Andrew Bartlett abartlet at samba.org
Mon Mar 26 07:13:43 UTC 2018

On Mon, 2018-03-26 at 09:08 +0200, mj via samba wrote:
> Hi,
> No one knows..?
> My guess is:
> - SamLogon,network is an interactive logon, so a user typing a password 
> on a windows domain joined workstation

No, that would be SamLogon,interactive.

SamLogon,network is NTLM authentication accessing another server in the
domain (in general). 

> - Kerberos KDC,ENC-TS Pre-authentication is something like: an already 
> logged on user accessing another server within the same AD doain

No, that is most likely a user getting their first ticket on logon.  

I'm glad to hear you are making good use of the audit log feature. 

I hope this helps,

Andrew Bartlett

Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

More information about the samba mailing list