A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.

  Account Information:
   Account Name:        %1
   Account Domain:        %2
   Logon GUID:        %11

  Authentication Policy Information:
   Silo Name:        %13
   Policy Name:        %14

  Device Information:
   Device Name:        %3

  Service Information:
   Service Name:        %4
   Service ID:        %5

  Network Information:
   Client Address:        %8
   Client Port:        %9

  Additional Information:
   Ticket Options:        %6
   Ticket Encryption Type:    %7
   Failure Code:        %10
   Transited Services:    %12

  This event is generated every time access is requested to a resource such as a computer or a Windows
  service.  The service name indicates the resource to which access was requested.

  This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.
   The logon event occurs on the machine that was accessed, which is often a different machine than the
  domain controller which issued the service ticket.

  Ticket options, encryption types, and failure codes are defined in RFC 4120.