Event ID: 4770

A Kerberos service ticket was renewed

A Kerberos service ticket was renewed.

Account Information:
    Account Name:       %1
    Account Domain:     %2

Service Information:
    Service Name:       %3
    Service ID:     %4

Network Information:
    Client Address:     %7
    Client Port:        %8

Additional Information:
    Ticket Options:     %5
    Ticket Encryption Type: %6

Ticket options and encryption types are defined in RFC 4120.

Generated for every TGS (Ticket Granting Service) ticket renewal.

Auditing:     Rarely

This event is generally only useful for troubleshooting purposes.

Volume:     High Very High

Microsoft Documentation

Event ID - 4770

Name Field Insertion String OS Example
Account Name TargetUserName %1 Any SERVERXYZ@THEDOMAIN.LOCAL
Account Domain TargetDomainName %2 Any THEDOMAIN.LOCAL
Service Name ServiceName %3 Any krbtgt
Service ID ServiceSid %4 Any THEDOMAIN\krbtgt
Ticket Options TicketOptions %5 Any 0x2
Ticket Encryption Type TicketEncryptionType %6 Any View Codes
Client Address IpAddress %7 Any
Client Port IpPort %8 Any 49987

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Kerberos Service Ticket Operations"

LEFT/RIGHT arrow keys for navigation

Back to List