Event Details
User Activity->Logons->Successful Logons->Windows 2008->EventID 4769 - A Kerberos service ticket was requested - Success.
EventID 4769 - A Kerberos service ticket was requested - Success.
 Sample:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/27/2009 9:58:02 PM
Event ID:      4769
Task Category: Kerberos Service Ticket Operations
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      dcc1.Logistics.corp
Description:   
A Kerberos service ticket was requested.
Account Information:
	Account Name:		DCC1$@LOGISTICS.CORP
	Account Domain:		LOGISTICS.CORP
	Logon GUID:		                     {9A6EBA7B-42EE-E3E3-EC65-5DD3DD4C77A9}
Service Information:
	Service Name:		DCC1$
	Service ID:		                     S-1-5-21-1135140816-2109348461-2107143693-1000
Network Information:
	Client Address:		::1
	Client Port:		                     0
Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	                     0x12
	Failure Code:		0x0
	Transited Services:	-
This event is generated every time access is requested to a resource such as a computer or a Windows service.  
The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  
The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120.
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows Vista (2008)
Windows 7 (2008 R2)
Windows 8 (2012)
Windows 8.1 (2012 R2)
Windows 10 (2016)
Category Account Logon
Source Microsoft-Windows-Security-Auditing
TaskCategory Kerberos Service Ticket Operations
EventId 4769
Type Success Audit
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime
Who Account or user name under which the activity occured. Account Name Administrator$@LOGISTICS.CORP
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Kerberos Service Ticket Operations" Kerberos Service Ticket Operations
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. Network Information: Client Address ::ffff:10.10.0.3
Severity Specify the seriousness of the event. "High" High
WhoDomain Account Domain LOGISTICS.CORP
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Comments
You must be logged in to comment