Event ID: 4770

A Kerberos service ticket was renewed

A Kerberos service ticket was renewed.

Account Information:
    Account Name:       %1
    Account Domain:     %2

Service Information:
    Service Name:       %3
    Service ID:     %4

Network Information:
    Client Address:     %7
    Client Port:        %8

Additional Information:
    Ticket Options:     %5
    Ticket Encryption Type: %6

Ticket options and encryption types are defined in RFC 4120.
Microsoft Documentation

Event ID - 4770


Recommended Auditing
This event is generally only useful for troubleshooting purposes.

Volume
High


Generated for every TGS (Ticket Granting Service) ticket renewal.



Name Field Insertion String OS Example
Account Name TargetUserName %1 Any SERVERXYZ@THEDOMAIN.LOCAL
Account Domain TargetDomainName %2 Any THEDOMAIN.LOCAL
Service Name ServiceName %3 Any krbtgt
Service ID ServiceSid %4 Any THEDOMAIN\krbtgt
Ticket Options TicketOptions %5 Any 0x2
Ticket Encryption Type TicketEncryptionType %6 Any View Codes
Client Address IpAddress %7 Any 10.1.0.55
Client Port IpPort %8 Any 49987


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Kerberos Service Ticket Operations"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List