Event-o-Pedia EventID 5168 - SPN check for SMB/SMB2 fails.

	Event Details
	User Activity->Object Access->File System Object Access->Windows 2008->EventID 5168 - SPN check for SMB/SMB2 fails.

EventID 5168 - SPN check for SMB/SMB2 fails.

Linked Event:

EventID 5168 - SPN check for SMB/SMB2 fails.

Sample:

SPN check for SMB/SMB2 fails.

Subject
 Security ID: %1
 Account Name: %2
 Account Domain: %3
 Logon ID: %4

SPN:
 SPN Name: %5
 Error Code: %6

Server Information:
 Server Names: %7
 Configured Names %8
 IP Addresses: %9

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2) Windows 10 (2016)
Category	Object Access
Source	Microsoft-Windows-Security-Auditing
TaskCategory	File Share
EventId	5168

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	-	1/1/2000
Who	Account or user name under which the activity occured.	Account Name	DCC1$
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"SPN check for SMB failed"	SPN check for SMB failed
Where	The name of the workstation/server where the activity was logged.	-	10.10.10.10
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	-	High
WhoDomain		Account Domain	LOGISTICS
WhereDomain		-
Result	Successful or Failed	"Failed"	Failed
Object Name		Object Name
Object Type		"SPN"	SPN
Whom		-