4769(S, F): A Kerberos service ticket was requested.

Subcategory: Audit Kerberos Service Ticket Operations

Event Description:

This event generates every time Key Distribution Center gets a Kerberos Ticket Granting Service (TGS) ticket request.

This event generates only on domain controllers.

If TGS issue fails then you'll see Failure event with Failure Code field not equal to “0x0”.

You'll typically see many Failure events with Failure Code “0x20”, which simply means that a TGS ticket has expired. These are informational messages and have little to no security relevance.

Note  For recommendations, see Security Monitoring Recommendations for this event.

Event XML:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4769</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14337</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-08-07T18:13:46.043256100Z" />
<EventRecordID>166746</EventRecordID>
<Correlation />
<Execution ProcessID="520" ThreadID="1496" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserName">dadmin@CONTOSO.LOCAL</Data>
<Data Name="TargetDomainName">CONTOSO.LOCAL</Data>
<Data Name="ServiceName">WIN2008R2$</Data>
<Data Name="ServiceSid">S-1-5-21-3457937927-2839227994-823803824-2102</Data>
<Data Name="TicketOptions">0x40810000</Data>
<Data Name="TicketEncryptionType">0x12</Data>
<Data Name="IpAddress">::ffff:10.0.0.12</Data>
<Data Name="IpPort">49272</Data>
<Data Name="Status">0x0</Data>
<Data Name="LogonGuid">{F85C455E-C66E-205C-6B39-F6C60A7FE453}</Data>
<Data Name="TransmittedServices">-</Data>
</EventData>
</Event>

Required Server Roles: Active Directory domain controller.

Minimum OS Version: Windows Server 2008.

Event Versions: 0.

Field Descriptions:

Account Information:

• Account Name [Type = UnicodeString]: the user name of the account that requested the ticket in the User Principal Name (UPN) syntax. Computer account name ends with $ character in the user name part. This field typically has the following value format: user_account_name@FULL_DOMAIN_NAME.

  • User account example: dadmin@CONTOSO.LOCAL

  • Computer account example: WIN81$@CONTOSO.LOCAL

    Note Although this field is in the UPN format, this isn't the attribute value of "UserPrincipalName" of the user account. It is the "normalized" name or implicit UPN. It is built from the user SamAccountName and the Active Directory domain name.

    This parameter in this event is optional and can be empty in some cases.

• Account Domain [Type = UnicodeString]: the name of the Kerberos Realm that Account Name belongs to. This can appear in a variety of formats, including the following:

  • Domain NETBIOS name example: CONTOSO

  • Lowercase full domain name: contoso.local

  • Uppercase full domain name: CONTOSO.LOCAL

    This parameter in this event is optional and can be empty in some cases.

• Logon GUID [Type = GUID]: a GUID that can help you correlate this event (on a domain controller) with other events (on the target computer for which the TGS was issued) that can contain the same Logon GUID. These events are “4624: An account was successfully logged on”, “4648(S): A logon was attempted using explicit credentials” and “4964(S): Special groups have been assigned to a new logon.”

  This parameter might not be captured in the event, and in that case appears as “{00000000-0000-0000-0000-000000000000}”.

Note  GUID is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances.

Service Information:

• Service Name [Type = UnicodeString]: the name of the account or computer for which the TGS ticket was requested.

  • This parameter in this event is optional and can be empty in some cases.

• Service ID [Type = SID]: SID of the account or computer object for which the TGS ticket was requested. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID can't be resolved, you'll see the source data in the event.

  • NULL SID – this value shows in Failure events.

Note  A security identifier (SID) is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it can't ever be used again to identify another user or group. For more information about SIDs, see Security identifiers.

Network Information:

• Client Address [Type = UnicodeString]: IP address of the computer from which the TGS request was received. Formats vary, and include the following:

  • IPv6 or IPv4 address.

  • ::ffff:IPv4_address.

  • ::1 - localhost.

• Client Port [Type = UnicodeString]: source port number of client network connection (TGS request connection).

  • 0 for local (localhost) requests.

Additional information:

• Ticket Options: [Type = HexInt32]: this is a set of different Ticket Flags in hexadecimal format.

  Example:

  • Ticket Options: 0x40810010

  • Binary view: 01000000100000010000000000010000

  • Using MSB 0 bit numbering we have bit 1, 8, 15 and 27 set = Forwardable, Renewable, Canonicalize, Renewable-ok.

Note  In the table below “MSB 0” bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left.

The most common values:

• 0x40810010 - Forwardable, Renewable, Canonicalize, Renewable-ok

• 0x40810000 - Forwardable, Renewable, Canonicalize

• 0x60810010 - Forwardable, Forwarded, Renewable, Canonicalize, Renewable-ok

• Ticket Encryption Type: [Type = HexInt32]: the cryptographic suite that was used for issued TGS.

• Failure Code [Type = HexInt32]: hexadecimal result code of TGS issue operation. Some errors are only reported when you set KdcExtraLogLevel registry key value with the following flags:
• 0x01: Audit SPN unknown errors.
• 0x10: Log audit events on encryption type (ETYPE) and bad options errors.

The table below contains the list of the most common error codes for this event:

• Transited Services [Type = UnicodeString]: this field contains list of SPNs which were requested if constrained Kerberos delegation was used.

Note  Service Principal Name (SPN) is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host.

Security Monitoring Recommendations

For 4769(S, F): A Kerberos service ticket was requested.

• If you know that Account Name should never request any tickets for (that is, never get access to) a particular computer account or service account, monitor for 4769 events with the corresponding Account Name and Service ID fields.

• You can track all 4769 events where the Client Address isn't from your internal IP range or not from private IP ranges.

• If you know that Account Name should be able to request tickets (should be used) only from a known allow list of IP addresses, track all Client Address values for this Account Name in 4769 events. If Client Address isn't from your allow list of IP addresses, generate the alert.

• All Client Address = ::1 means local TGS requests, which means that the Account Name logged on to a domain controller before making the TGS request. If you have an allow list of accounts allowed to log on to domain controllers, monitor events with Client Address = ::1 and any Account Name outside the allow list.

• All 4769 events with Client Port field value > 0 and < 1024 should be examined, because a well-known port was used for outbound connection.

• Monitor for a Ticket Encryption Type of 0x1 or 0x3, which means the DES algorithm was used. DES should not be in use, because of low security and known vulnerabilities. It is disabled by default starting from Windows 7 and Windows Server 2008 R2.

• Starting with Windows Vista and Windows Server 2008, monitor for a Ticket Encryption Type other than 0x11 and 0x12. These are the expected values, starting with these operating systems, and represent AES-family algorithms.

• If you have a list of important Failure Codes, monitor for these codes.