Event-o-Pedia EventID 674 - Service Ticket Renewed [Win 2003]

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Account Logon->EventID 674 - Service Ticket Renewed [Win 2003]

EventID 674 - Service Ticket Renewed [Win 2003]

Indicates automatic AS (Authentification Server) ticket or TGS (Ticket Granting Server) ticket renewal .

Note: There is no Failure Audit form of this audit event record.

Some fields provide codes as values. Refer to the following link in order to see human-readable descriptions:

Ticket Encryption Type

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2000

EventID 674 - Ticket Granted Renewed [Win 2000]

Windows 2008

EventID 4770 - A Kerberos service ticket was renewed

Sample:

        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Account Logon
        Event ID:       674
        Date:           11/13/2009
        Time:           11:32:59
        User:           NT AUTHORITY\SYSTEM
        Computer:       DC1
        Description:
        Service Ticket Renewed:
        User Name:		Paul@RESEARCH.CORP
        User Domain:	RESEARCH.CORP
        Service Name:		krbtgt
        Service ID:		%{S-1-5-21-746137067-343818398-839522115-502}
        Ticket Options:		0x40810010
        Ticket Encryption Type:	0x17
        Client Address:		127.0.0.1

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2003
Category	Account Logon
Source	Security
EventId	674

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Category	A name for a subclass of events within the same Event Source.	Category	Logon/Logoff
User Name	Account name of the user/computer requesting the ticket	InsertionString1	Paul@RESEARCH.CORP
User Domain	User/computer account's DNS suffix	InsertionString2	RESEARCH.CORP
Service Name	The service to which access was requested or the service that issued the ticket.	InsertionString3	krbtgt
Service ID	The account name of the service in the following format: domain name\service account name	InsertionString4	%{S-1-5-21-746137067-343818398-839522115-502}
Ticket Options	A hexadecimal number representing the Key Distribution Center (KDC) Option flags that were used or requested when the ticket was issued. KDC Option flags include information such as whether a ticket can be forwarded or renewed. The number in the Ticket Options field is a bit mask.	InsertionString5	0x40810010
Ticket Encryption Type	The code for the Kerberos encryption type (etype) used on the ticket request. Please find the code descriptions here.	InsertionString6	0x17
Client Address	IP address of the workstation from which the user logged on.	InsertionString7	127.0.0.1