Event Details
User Activity->Logons->Failed Logons->Windows 2000-2003->EventID 673 - Service Ticket Request [Win 2003]
EventID 673 - Service Ticket Request [Win 2003]
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Account Logon
        Event ID:       673
        Date:           10/26/2009
        Time:           07:31:56
        User:           NT AUTHORITY\SYSTEM
        Computer:       DC1
        Description:
        Service Ticket Request:
        User Name:		Paul@RESEARCH.CORP
        User Domain:		RESEARCH.CORP
        Service Name:		DC1$
        Service ID:		{S-1-5-21-184992632-1607737289-1287950321-1003}
        Ticket Options:		0x40810000
        Ticket Encryption Type:	0x17
        Client Address:		127.0.0.1
        Failure Code:		-
        Logon GUID:		{dc1ddb20-3e58-b918-6c94-db2c903a70ff}
        Transited Services:	                     -
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Category Account Logon
Source Security
EventId 673
Type Failure Audit
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name Paul@RESEARCH.CORP
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Kerberos Service Ticket Operations" Kerberos Service Ticket Operations
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Client Address 127.0.0.1
Severity Specify the seriousness of the event. "High" High
WhoDomain User Domain RESEARCH.CORP
WhereDomain -
Result Successful or Failed. "Failed" Failed
Failure Reason Failure Reason - Bad user name or password, not enough privileges, etc. Failure Code -
Comments
You must be logged in to comment