Event ID 4768
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).A Kerberos authentication ticket (TGT) was requested. Account Information: Account Name: %1 Supplied Realm Name: %2 User ID: %3 Service Information: Service Name: %4 Service ID: %5 Network Information: Client Address: %10 Client Port: %11 Additional Information: Ticket Options: %6 Result Code: %7 Ticket Encryption Type: %8 Pre-Authentication Type: %9 Certificate Information: Certificate Issuer Name: %12 Certificate Serial Number: %13 Certificate Thumbprint: %14 Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
If TGT issue fails then you will see Failure event with Result Code field not equal to “0x0”.
This event doesn't generate for Result Codes: 0x10, 0x17 and 0x18. Event “4771: Kerberos pre-authentication failed.” generates those instead.
CJIS 5.4.1.1.1
ISO 27001:2013 A.12.4.1
ISO 27001:2013 A.12.4.3
NIST 800-171: 3.1.1
CMMC L1
NIST SP 800-53: AC-2
PCI 3.2.1: 10.2.4
This auditing subcategory monitors Kerberos AS_REQ requests.
Microsoft Documentation
Name | Field | Insertion String | OS | Example | ||
---|---|---|---|---|---|---|
Account Name | TargetUserName | %1 | Any | someadmin | ||
Supplied Realm Name | TargetDomainName | %2 | Any | thedomain.local | ||
User ID | TargetSid | %3 | Any | THEDOMAIN\someadmin | ||
Service Name | ServiceName | %4 | Any | krbtgt | ||
Service ID | ServiceSid | %5 | Any | THEDOMAIN\krbtgt | ||
Ticket Options | TicketOptions | %6 | Any | 0x40810010 | ||
Result Code | Status | %7 | Any | View Codes | ||
Ticket Encryption Type | TicketEncryptionType | %8 | Any | View Codes | ||
Pre-Authentication Type | PreAuthType | %9 | Any | View Codes | ||
Client Address | IpAddress | %10 | Any | ::ffff:192.168.112.14 | ||
Client Port | IpPort | %11 | Any | 46754 | ||
Certificate Issuer Name | CertIssuerName | %12 | Any | thedomain-dc01-ca-1 | ||
Certificate Serial Number | CertSerialNumber | %13 | Any | 1D0000000D292FBE3C6CDDAFA200020000000D | ||
Certificate Thumbprint | CertThumbprint | %14 | Any | 564DFAEE99C71D62ABC553E695BD8DBC46669413 |
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Kerberos Authentication Service"
LEFT/RIGHT arrow keys for navigation
Back to List