// events/4768 · Kerberos

Event ID 4768A Kerberos authentication ticket (TGT) was requested

A domain controller handled a request for a Ticket Granting Ticket. A Result Code other than 0x0 means the request failed. Bad passwords (0x18) and smart card PADATA issues (0x10) show up as 4771 instead.

Log	`Security`
Source	`Microsoft-Windows-Security-Auditing`
Area	Kerberos

What to check

Check the Result Code and Client Address. Flag DES encryption types (0x1, 0x3), pre-authentication type 0 and repeated 0x6 (possible user enumeration).

Codes you'll see in this event

Code	Meaning
`0x6`	KDC_ERR_C_PRINCIPAL_UNKNOWN: user name not found.
`0x7`	KDC_ERR_S_PRINCIPAL_UNKNOWN: server name not found in Active Directory.
`0xC`	KDC_ERR_POLICY: logon restriction, such as workstation, smart card or logon hours.
`0xE`	KDC_ERR_ETYPE_NOTSUPP: no supported encryption type.
`0x12`	KDC_ERR_CLIENT_REVOKED: account disabled, expired or locked out.
`0x17`	KDC_ERR_KEY_EXPIRED: password has expired.
`0x25`	KRB_AP_ERR_SKEW: clock skew too great between client and DC.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4768 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines

1
2
3
4
5SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4768
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Kerberos events

Event ID 4769: A Kerberos service ticket was requested
Event ID 4771: Kerberos pre-authentication failed
Event ID 4: KRB_AP_ERR_MODIFIED from the server

Search all 123 event IDs →

Sources

Microsoft documentation for event 4768