Event ID 4768 and 4769: Kerberos ticket requests

In a Windows domain almost every logon is Kerberos. The domain controller logs each ticket: 4768 when an account gets its logon ticket (TGT), 4769 when it asks for a ticket to a service. Failures show wrong passwords and locked accounts; a burst of old RC4 service tickets for many service accounts is the signature of Kerberoasting – an attack that cracks service account passwords offline.

1. The fields that matter

• Account Name (TargetUserName): the account requesting the ticket.
• Service Name (ServiceName): krbtgt for 4768; for 4769 the service account or computer the ticket is for.
• Client Address (IpAddress): where the request came from (::ffff: prefix = IPv4).
• Result Code (Status) and Ticket Encryption Type (TicketEncryptionType): 0x12 AES256, 0x11 AES128, 0x17 RC4.

Audit subcategories Kerberos Authentication Service (4768) and Kerberos Service Ticket Operations (4769), on domain controllers. Check with auditpol /get /category:"Account Logon".

2. Failure codes (4768)

Code	Meaning
0x6	Unknown user name – typos, old scripts, or someone guessing account names.
0x12	Account disabled, expired, locked out or outside logon hours.
0x17	Password expired.
0x18	Wrong password (usually logged as 4771 instead).
0x25	Clock skew: the client's time is too far off.

3. PowerShell: failures and a Kerberoasting check

On a domain controller, as administrator:

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
# failed TGT requests, grouped
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
  ForEach-Object { Get-EventFields $_ } | Where-Object Status -ne '0x0' |
  Group-Object Status, TargetUserName, IpAddress | Sort-Object Count -Descending | Select-Object -First 20 Count, Name
# RC4 service tickets per requesting account (many different services = Kerberoasting)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
  ForEach-Object { Get-EventFields $_ } | Where-Object { $_.TicketEncryptionType -eq '0x17' -and $_.ServiceName -notlike '*$' } |
  Group-Object TargetUserName | Sort-Object Count -Descending |
  Select-Object Count, Name, @{n='Services';e={($_.Group.ServiceName | Sort-Object -Unique).Count}}

4. Against Kerberoasting

• Long, random passwords (25+ characters) for every service account with a service principal name – or group managed service accounts (gMSA), whose passwords Windows rotates.
• Allow only AES for service accounts (attribute msDS-SupportedEncryptionTypes) and phase out RC4.
• Keep the number of service accounts with an SPN small and remove old ones.

5. Let Coinetic watch it for you

Coinetic works where most of these logons start – on the way in:

• Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – Remote Desktop, Windows logons, VPN, SQL Server and more.
• Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
• Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.

More guides: all Coinetic guides.

Frequently asked

Why do I not see 4768 on member Servers?

Kerberos tickets are issued by domain controllers, so these events exist only there. Member Servers log the resulting logons (4624).

Is every RC4 ticket an attack?

No. Old systems and accounts without AES keys still use RC4. The warning sign is one account requesting RC4 tickets for many different services in a short time.

Where are wrong passwords for Kerberos?

In Event 4771 (pre-authentication failed, code 0x18) on the domain controller - see the guide on 4740 and 4771.