Log Dejargonizer

Windows Security Log · Event 4768

Event 4768: A Kerberos ticket (TGT) was requested

An account asked a domain controller for the ticket that lets it request everything else. It is the moment authentication actually happens in Active Directory — and two of its fields expose encryption downgrade and AS-REP roasting, which little else will show you.

Also written as Event ID 4768TGT requested4768 kerberos

What it means for you

On a personal computer

This only appears on Windows Server domain controllers in a business network.

For an analyst

Recorded on the domain controller that issued the ticket. Ticket Encryption Type 0x17 is RC4, which modern domains should rarely need — a sudden appearance of RC4 for an account that normally uses AES is the Kerberoasting downgrade pattern. Pre-Authentication Type 0 means no pre-authentication, which is AS-REP roasting territory. Note that failures here overlap with 4771; which you see depends on where the request failed.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A Kerberos authentication ticket (TGT) was requested.

Account Information:
  Account Name:   svc-legacy
  Supplied Realm Name: CORP
  User ID:        CORP\svc-legacy

Service Information:
  Service Name:   krbtgt
  Service ID:     CORP\krbtgt

Network Information:
  Client Address: ::ffff:192.0.2.44
  Client Port:    50912

Additional Information:
  Ticket Options: 0x40810010
  Result Code:    0x0
  Ticket Encryption Type: 0x17
  Pre-Authentication Type: 2

The fields that decide it

Everything else in the log line is context.

TargetUserName
The account requesting the ticket. Names ending in $ are computer accounts.
IpAddress
Where the request came from. Genuine network data rather than a client-supplied name, often in IPv6-mapped form.
TicketEncryptionType
The encryption used for the ticket. The field most worth watching.
  • 0x12AES256-CTS-HMAC-SHA1-96. The modern default and what you want to see.
  • 0x11AES128. Also fine.
  • 0x17RC4-HMAC. Weak, and what an attacker downgrades to because it is far cheaper to crack offline.
  • 0x18RC4-HMAC-EXP. Export-grade and weaker still.
PreAuthType
How the client proved it knew the password before the ticket was issued.
  • 2Encrypted timestamp. The normal case.
  • 0No pre-authentication. The account is AS-REP roastable — material can be requested and cracked offline without authenticating.
  • 15Smart card certificate.
  • 138Encrypted challenge, used with newer clients.
Status
The result. 0x0 is success.
  • 0x0The ticket was issued.
  • 0x6The account does not exist. A run of these is username enumeration.
  • 0x12The account is disabled, locked, or expired.
  • 0x17The password has expired.
  • 0x18Pre-authentication failed — the password was wrong.
  • 0x25Clock skew between client and domain controller exceeds the tolerance.
ServiceName
Normally krbtgt, which is the ticket-granting service itself.

Ordinary reasons this happens

Most of the time it is one of these.

  • Every sign-in in an Active Directory domain, which is the bulk of the volume.
  • Computer accounts authenticating to the domain continuously.
  • Service accounts obtaining tickets on a schedule.
  • Ticket renewal as sessions continue through the day.
  • Legacy applications and appliances that genuinely still require RC4.

When it is not ordinary

Encryption downgrade before Kerberoasting.

What gives it awayTicketEncryptionType 0x17 for an account that normally receives 0x12. RC4 tickets are dramatically cheaper to crack offline, so attackers request them deliberately.

ATT&CK T1558.003

AS-REP roasting.

What gives it awayPreAuthType 0, meaning material can be requested for that account and attacked offline without ever authenticating.

ATT&CK T1558.004

Username enumeration against the domain.

What gives it awayA run of failures with status 0x6, distinguishing accounts that exist from those that do not.

ATT&CK T1589.002

A forged golden ticket in use.

What gives it awayRequests for accounts that do not exist in the directory, or tickets with anomalous lifetimes, following a compromise of the krbtgt account.

ATT&CK T1558.001

Credential guessing against the domain.

What gives it awayMany 0x18 failures across accounts from one source address.

ATT&CK T1110.003

What to do next

  1. Filter to TicketEncryptionType 0x17 first and compare against what those accounts normally receive.
  2. Filter to PreAuthType 0 — that set should be empty, and every member of it is a finding.
  3. For failures, read the status code before anything else; 0x6 and 0x18 mean different things about attacker knowledge.
  4. Strip the IPv6-mapped prefix from the address before matching against your network ranges.
  5. Correlate RC4 requests with 4769 service ticket requests from the same source to see the full Kerberoasting shape.
  6. For 0x25, fix time synchronisation on the client rather than investigating the account.

Queries to run

kql RC4 tickets for real user accounts. Baseline your legacy applications first, then everything remaining is worth reading. 
SecurityEvent | where EventID == 4768 and TicketEncryptionType == '0x17' | where TargetUserName !endswith '$' | summarize count() by TargetUserName, IpAddress, bin(TimeGenerated, 1h) | order by count_ desc
kql AS-REP roastable accounts being requested. This should return nothing. 
SecurityEvent | where EventID == 4768 and PreAuthType == '0' | project TimeGenerated, Computer, TargetUserName, IpAddress
kql Username enumeration — many nonexistent accounts tried from one source. 
SecurityEvent | where EventID == 4768 and Status == '0x6' | summarize attempts = count(), accounts = dcount(TargetUserName) by IpAddress, bin(TimeGenerated, 30m) | where accounts > 10
powershell Which accounts are currently roastable, independent of whether anyone has tried yet. 
Get-ADUser -Filter { DoesNotRequirePreAuth -eq $true } -Properties DoesNotRequirePreAuth | Select-Object SamAccountName
splunk 
index=wineventlog EventCode=4768 Ticket_Encryption_Type=0x17 | stats count by user src_ip | sort -count

Common questions

What does Ticket Encryption Type 0x17 mean?

RC4-HMAC, an older and much weaker cipher than the AES types. Modern domains should mostly issue 0x12. RC4 matters because tickets encrypted with it are far cheaper to crack offline, so attackers request it deliberately — a downgrade for an account that normally gets AES is a genuine signal.

What is the difference between Event 4768 and Event 4771?

4768 records the ticket request itself, successful or not. 4771 records specifically that pre-authentication failed. They overlap for wrong passwords, and which one you see depends on where in the exchange the failure occurred. Collect both — 4768 carries the encryption and pre-authentication type fields that 4771 does not.

What does Pre-Authentication Type 0 mean?

No pre-authentication was performed, because the account has that requirement disabled. It matters because anyone can then request encrypted material for the account and attack it offline without authenticating and without generating a failed logon. That set of accounts should normally be empty.

Why is Event 4768 so high volume?

Every authentication in the domain produces one, and that includes every computer account talking to the domain, every service starting, and every ticket renewal. On a busy domain controller it is one of the highest-volume events. Collect it filtered by encryption type and pre-authentication type rather than in full.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026