Event ID 4770
A Kerberos service ticket was renewedA Kerberos service ticket was renewed. Account Information: Account Name: %1 Account Domain: %2 Service Information: Service Name: %3 Service ID: %4 Network Information: Client Address: %7 Client Port: %8 Additional Information: Ticket Options: %5 Ticket Encryption Type: %6 Ticket options and encryption types are defined in RFC 4120.
Generated for every TGS (Ticket Granting Service) ticket renewal.
Auditing:
Rarely
This event is generally only useful for troubleshooting purposes.
Volume:
High
Very High
Microsoft Documentation
Name | Field | Insertion String | OS | Example | ||
---|---|---|---|---|---|---|
Account Name | TargetUserName | %1 | Any | SERVERXYZ@THEDOMAIN.LOCAL | ||
Account Domain | TargetDomainName | %2 | Any | THEDOMAIN.LOCAL | ||
Service Name | ServiceName | %3 | Any | krbtgt | ||
Service ID | ServiceSid | %4 | Any | THEDOMAIN\krbtgt | ||
Ticket Options | TicketOptions | %5 | Any | 0x2 | ||
Ticket Encryption Type | TicketEncryptionType | %6 | Any | View Codes | ||
Client Address | IpAddress | %7 | Any | 10.1.0.55 | ||
Client Port | IpPort | %8 | Any | 49987 |
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Kerberos Service Ticket Operations"
Operating Systems:
Windows 2008 Windows 2008 R2 Windows 2012 Windows 2012 R2 Windows 2016 Windows 2019 Windows 2022Tags:
Domain Controller Audit SuccessLEFT/RIGHT arrow keys for navigation
Back to List