Event ID 4768: kerberos tgt requested
What Event ID 4768 (kerberos tgt requested) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4768 is logged on a domain controller when a Kerberos ticket-granting ticket (TGT) is requested, which happens at every domain logon. Two fields make it valuable for detection: the result code and the pre-authentication type.
The fields that matter
| Field | What it tells you |
|---|---|
| Account Name | The account requesting the ticket. |
| Client Address | Where the request came from. |
| Result Code | 0x0 success, 0x6 unknown user, 0x12 account disabled, locked or expired, 0x17 password expired. |
| Ticket Encryption Type | 0x12 AES256, 0x11 AES128, 0x17 RC4. |
| Pre-Authentication Type | 2 normal password pre-authentication, 0 none, 15 and 16 smart card or certificate. |
What is normal
Successful requests with AES encryption from users' own devices.
When Event ID 4768 is suspicious
- Pre-Authentication Type
0: the account doesn't require pre-authentication and its ticket can be cracked offline (AS-REP roasting). - Bursts of
0x6from one address: someone is guessing which user names exist. - RC4 (
0x17) in a domain where everything supports AES.
Common false positive: Old devices and some appliances still request RC4. Inventory them before treating RC4 as malicious.
Find Event ID 4768 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4768
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4769: Kerberos service ticket requested
- Event ID 4771: Kerberos pre-authentication failed
- Event ID 4776: NTLM credential validation
- Event ID 4624: Successful logon
FAQ
How do I find accounts that allow AS-REP roasting?
Look for accounts with "Do not require Kerberos preauthentication" set: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}. Turn it off unless a documented app needs it.
Why don't failed passwords show up as 4768?
A wrong password fails at pre-authentication and is logged as 4771. 4768 failures are mostly about the account itself.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.