Event ID 4768: Decode a Kerberos TGT Request, Free in Your Browser

After the January 14, 2025 cumulative update, a 4768 on Windows Server 2016 and later shows extra fields: the supported encryption types and available keys of the account, the service and the domain controller, plus the encryption types the client advertised.

Microsoft’s page marks them “New”. The fields below exist on both versions.

Account Name and Supplied Realm Name

• Account Name. The account the TGT was requested for; a computer account ends in a $ character.
• Supplied Realm Name. The Kerberos realm the account belongs to. Microsoft notes it can appear as the NetBIOS name (CONTOSO), the lowercase domain name or the uppercase domain name, so do not match on one spelling only.
• User ID. It shows a NULL SID in failure events.

Service Name

For a TGT request this is normally krbtgt, the ticket-granting service. In failure events, Microsoft says, it typically looks like krbtgt/REALM_NAME.

Client Address and Client Port

Client Address is where the request came from. Microsoft lists three formats:

• a plain IPv4 or IPv6 address;
• an IPv4 address in the form ::ffff:IPv4_address (an IPv4 address carried in IPv6 notation);
• ::1 for localhost.

Client Port is 0 for local requests.

• The ::ffff: prefix. It is only a notation; it does not indicate a different machine or a spoofed address. Strip it before you compare against an address list.
• Client port. Microsoft’s monitoring notes suggest examining requests with a client port above 0 and below 1024, because a well-known port was used for an outbound connection.

Ticket Options

Ticket Options is a set of ticket flags written as a hexadecimal number.

Microsoft’s page numbers the bits from the left (the style used in RFC documents) and gives three common values:

For the first row, bits 1, 8, 15 and 27 are set. Microsoft’s description of each:

• Forwardable means the ticket-granting service may issue a new TGT with a different network address.
• Renewable is used with the end time and renew-till fields so long-lived tickets are renewed at the KDC periodically.
• Name-canonicalize is what a client must request to receive referrals.
• Renewable-ok says a renewable ticket is acceptable if a ticket of the requested life cannot otherwise be provided.

Ticket Options show what the client asked for. They are usually worth reading only when two requests from the same account look different.

Ticket Encryption Type

This is the cipher suite used for the issued TGT. Values from Microsoft’s page:

Why RC4 and DES deserve a look.

• DES. Microsoft’s monitoring recommendations say that DES (0x1 or 0x3) should not be in use, “because of low security and known vulnerabilities”.
• Anything but AES. They say to monitor for any value other than 0x11 and 0x12 on Windows Vista, Windows Server 2008 and later, because those AES values are the expected ones.
• RC4 (0x17). Not an attack on its own. It usually means an old service, an old account setting or a client that only offers RC4, so find which account and which client address keep producing it.
• AS-REP roasting. MITRE separately lists RC4 requests as an indicator, covered below.

Pre-Authentication Type

Pre-authentication is the step in which the client proves it knows the account’s key before the KDC sends anything encrypted with it.

Microsoft’s Table 5 lists these types:

Failure events show a dash. Microsoft’s monitoring table turns the list into checks. Alert on a value that is:

• not 2, if only password authentication is in use;
• not 15, for accounts that must use a smart card;
• not 138, if armoring is on for all Kerberos traffic.

Type 0 is the one Microsoft calls out: all accounts should use pre-authentication, “except accounts configured with ‘Do not require Kerberos preauthentication,’ which is a security risk”.

Result Code

0x0 means the TGT was issued; any other value is a failure. These are the most common codes, with Microsoft’s stated causes:

Microsoft also lists 0x17 (password expired) and 0x18 (wrong password) in its table, but adds that 0x10 and 0x18 can’t appear in a 4768; they appear in event 4771 instead.

For a wrong password, search 4771, not 4768. The names in the table follow the error codes in RFC 4120, section 7.5.9.