← cd ~/events
// events/4769 · Kerberos
Event ID 4769A Kerberos service ticket was requested
A domain controller handled a request for a service ticket (TGS). A Failure Code other than 0x0 means it failed; 0x20 (ticket expired) is routine and very common.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Kerberos |
What to check
Look at Ticket Encryption Type: on modern systems expect 0x11 or 0x12 (AES). Investigate DES (0x1, 0x3) and other non-AES types such as RC4 (0x17).
Codes you'll see in this event
| Code | Meaning |
|---|---|
0x11 | AES128-CTS-HMAC-SHA1-96 encryption. |
0x12 | AES256-CTS-HMAC-SHA1-96 encryption. |
0x17 | RC4-HMAC encryption: legacy, should not be needed on Vista/Server 2008 and later. |
0x20 | KRB_AP_ERR_TKT_EXPIRED: ticket expired, informational. |
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4769 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4769
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Kerberos events
- Event ID 4768: A Kerberos authentication ticket (TGT) was requested
- Event ID 4771: Kerberos pre-authentication failed
- Event ID 4: KRB_AP_ERR_MODIFIED from the server