How to enable Kerberos event logging

This registry change works for Windows 2000/2003 /2003R2 and Windows Server 2008 and used for tracing detailed Kerberos events through the Microsoft event log viewer.

Enabling Kerberos Event Logging on a Specific Computer

1. Start Registry Editor.
2. Add the following registry value:
   HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsaKerberosParameters

   Registry Value:

   LogLevel

   Value Type:

   REG_DWORD

   Value Data:

   0x1

   If the

   Parameters

   subkey does not exist, create it.

   Note Remove this registry value when it is no longer needed so that performance is not degraded on the computer. Also, you can remove this registry value to disable Kerberos event logging on a specific computer.

3. Quit Registry Editor. The setting will become effective immediately on Windows Server 2008, on Windows Vista, on Windows Server 2003, and on Windows XP. For Windows 2000, you must restart the computer.

You can find any Kerberos-related events in the system log.

source:  http://support.microsoft.com/kb/262177