Merge pull request #9175 from Deland-Han/cmpy-branch-ci6196

AB#6196: Server 2025 Active Directory Domain Controllers May Intermittently Log Event ID 7 Source: Microsoft-Windows-Kerberos-Key-Distribution-Center

Author: Deland-Han

support/windows-server/toc.yml

@@ -756,7 +756,7 @@ items:
     items:
     - name: Extend stand-alone tiered storage spaces
       href: ./backup-and-storage/extend-stand-alone-tiered-storage-spaces.md
-    - name: Manage disks in standalone Storage Spaces 
+    - name: Manage disks in standalone Storage Spaces
       href: ./backup-and-storage/manage-disks-standalone-storage-spaces.md
   - name: System Restore or resetting your computer
     items:
@@ -2902,6 +2902,8 @@ items:
       href: ./windows-security/description-support-suite-b-cryptographic-ipsec.md
   - name: Kerberos authentication
     items:
+    - name: Event ID 7 on a domain controller running Windows Server 2025
+      href: windows-security/event-id-7-on-domain-controllers.md
     - name: 'Troubleshooting guidance: Kerberos authentication'
       href: ./windows-security/kerberos-authentication-troubleshooting-guidance.md
     - name: Active Directory authentication fails with klist error 0x8009030e
@@ -2948,7 +2950,7 @@ items:
       href: ./windows-security/troubleshoot-kerberos-constrained-delegation-issues.md
     - name: Troubleshoot Kerberos using a log analysis test scenario
       href: ./windows-security/kerberos-authentication-log-analysis-test-scenario.md
-    - name: 'Troubleshoot resource-based constrained delegation issues'
+    - name: Troubleshoot resource-based constrained delegation issues
       href: ./windows-security/troubleshoot-kerberos-rbcd-issues.md
     - name: Troubleshoot SSO issues
       href: ./windows-security/troubleshoot-kerberos-sso-issues.md

support/windows-server/windows-security/event-id-7-on-domain-controllers.md

@@ -0,0 +1,74 @@
+---
+title: Event ID 7 Is Intermittently Logged on a Windows Server 2025-Based DC
+description: Describes an issue in which event ID 7 is intermittently logged on a Windows Server 2025-based DC.
+ms.date: 06/25/2025
+manager: dcscontentpm
+audience: itpro
+ms.topic: troubleshooting
+ms.reviewer: jories
+ms.custom:
+- sap:windows security technologies\kerberos authentication
+- pcy:WinComm Directory Services
+---
+# Event ID 7 is intermittently logged on a Windows Server 2025-based domain controller
+
+Active Directory domain controllers (DCs) that are running Windows Server 2025 might intermittently log event ID 7. This article provides suggestions for this error.
+
+## Event sample
+
+Here's a sample of the event:
+
+> Log Name: System  
+> Source: Microsoft-Windows-Kerberos-Key-Distribution-Center  
+> Date: \<date time\>  
+> Event ID: 7  
+> Task Category: None  
+> Level: Error  
+> Keywords: Classic  
+> User: N/A  
+> Computer: \<dc fqdn\>  
+> Description:  
+> The Security Account Manager failed a KDC request in an unexpected way. The error is in the data field. **The account name was** and lookup type 0x108.
+
+Event XML:
+
+```xml
+<Event
+xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+ <System>
+ <Provider Name="Microsoft-Windows-Kerberos-Key-Distribution-Center" Guid="(guid)" EventSourceName="KDC" />
+ <EventID Qualifiers="49152">7</EventID>
+ <Version>0</Version>
+ <Level>2</Level>
+ <Task>0</Task>
+ <Opcode>0</Opcode>
+ <Keywords>0x80000000000000</Keywords>
+ <TimeCreated SystemTime="(date time)" />
+ <EventRecordID>29550</EventRecordID>
+ <Correlation />
+ <Execution ProcessID="896" ThreadID="0" />
+ <Channel>System</Channel>
+ <Computer>(dc fqdn)</Computer>
+ <Security />
+ </System>
+ <EventData>
+ <Data Name="AccountName">
+ </Data>
+ <Data Name="LookupType">0x108</Data>
+ <Binary>0D0000C0</Binary>
+ </EventData>
+</Event>
+```
+
+> [!IMPORTANT]
+> The text of the event has a blank account name: **The account name was ...**.
+>
+> If the event ID lists a different account name or lookup type, it might be a separate issue that requires investigation.
+
+## Resolution
+
+Microsoft has acknowledged this issue. It doesn't affect computer functionality or performance. These events can be safely ignored when the account name is blank.
+
+## More information
+
+This issue only affects Windows Server 2025 when running as an Active Directory Key Distribution Center (KDC). Other versions of Windows Server don't have this issue.