Windows event ID 4649 - A replay attack was detected

Event ID: 

4649

Category: 

Logon/Logoff

Subcategory: 

Other Logon/Logoff Events

Supported on: 

Windows Vista, Windows Server 2008

A replay attack was detected.

Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4

Credentials Which Were Replayed:
Account Name: %5
Account Domain: %6

Process Information:
Process ID: %12
Process Name: %13

Network Information:
Workstation Name: %10

Detailed Authentication Information:
Request Type: %7
Logon Process: %8
Authentication Package: %9
Transited Services: %11

This event indicates that a Kerberos replay attack was detected- a request was received twice with identical information. This condition could be caused by network misconfiguration.

Related content