OpsVantage Tools
Tools Guides Event IDs opsvantage.net
Tools / Event IDs / Event ID 4769

Event ID 4769: kerberos service ticket requested

What Event ID 4769 (kerberos service ticket requested) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.

Log: Security · Severity: Informational · MITRE ATT&CK T1558.003 · Updated 2026-11-03

Event ID 4769 is logged when a Kerberos service ticket is requested, every time a user reaches a file share, SQL server or other service. It is the event that shows Kerberoasting: one account requesting tickets for many service accounts, usually with weak RC4 encryption, so the passwords can be cracked offline.

The fields that matter

FieldWhat it tells you
Account NameWho requested the ticket.
Service NameThe service account or computer the ticket is for.
Client AddressWhere the request came from.
Ticket Encryption Type0x12 AES256, 0x17 RC4. RC4 tickets are the ones attackers want.
Failure Code0x0 success.

What is normal

Thousands of requests for computer accounts (names ending in $) and for krbtgt, mostly with AES.

When Event ID 4769 is suspicious

Common false positive: Legacy applications that only support RC4 request RC4 tickets all day. Know them, and move them to AES where you can.

Find Event ID 4769 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4769
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated desc

Related events

FAQ

How do I detect Kerberoasting with 4769?

Exclude service names ending in $ and krbtgt, keep encryption type 0x17, and count distinct service names per account in a short window. Five or more is worth a look.

How do I reduce the risk?

Give service accounts long random passwords or use group managed service accounts, and set them to support AES only.