The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

Select all Open in new window

Additional information : ID:4, SOURCE:Microsoft-Windows-Security-Kerberos
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc$. The target name used was ldap/DC.XXX.local. This indicates that the target server failed to decrypt the ticket provided by the client. 
This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. 
This error can also happen if the target service account password is different than what is configured on the Kerberos 

Select all Open in new window

$LogonType = @{
	[uint32]2 = 'Interactive'
	[uint32]3 = 'Network'
	[uint32]4 = 'Batch'
	[uint32]5 = 'Service'
	[uint32]7 = 'Unlock'
	[uint32]8 = 'NetworkCleartext'
	[uint32]9 = 'NewCredentials'
	[uint32]10 = 'RemoteInteractive'
	[uint32]11 = 'CachedInteractive'
}
Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" | ForEach-Object {
    "Processing $($_.DNSHostName) ..." | Write-Host
	Get-WinEvent -ComputerName $_.Name -FilterHashTable @{LogName="Security"; ID=4624; Data="John.Wick"} -MaxEvents 200 | ForEach-Object {
		New-Object PSObject -Property ([ordered]@{
			MachineName = $_.MachineName
			TimeCreated = $_.TimeCreated
			User = $_.Properties[5].Value
			Domain = $_.Properties[6].Value
			LogonType = $_.Properties[8].Value
			LogonTypeString = $LogonType[$_.Properties[8].Value]
			SourceIP = $_.Properties[18].Value
			SourceName = (Resolve-DnsName -Name $_.Properties[18].Value -ErrorAction SilentlyContinue).NameHost
			Keywords = $_.KeywordsDisplayNames -join ";"
		})
	}
} | Export-Csv -Path C:\TEMP\John.csv -NoTypeInformation -UseCulture

Select all Open in new window

get-eventlog -logname "security" | where {($_.eventID -eq 4771) -or ($_.eventID -eq 4776) -or ($_.eventID -eq 4625) } | select timegenerated,message

Select all Open in new window