ZEKASTRA

SecurityKerberos and NTLM authentication

4768 · A Kerberos authentication ticket (TGT) was requested

Generated on domain controllers each time the Key Distribution Center issues, or fails to issue, a ticket-granting ticket. Status 0x0 means success.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • ServiceName
  • TicketOptions
  • Status
  • TicketEncryptionType
  • PreAuthType
  • IpAddress
  • IpPort
  • CertIssuerName
  • CertSerialNumber
  • CertThumbprint

02How to use it

IpAddress gives the client that authenticated; this is often the best domain-wide record of where an account was used. Note PreAuthType 0 (no pre-authentication) and legacy encryption types such as RC4 (0x17) or DES.

03Caveats

Requires Audit Kerberos Authentication Service on domain controllers. Pre-authentication failures (0x18) are logged as 4771, not 4768. Recent updates added fields, so field sets differ by build.

05Sources

  1. Microsoft Learn — 4768(S, F) A Kerberos authentication ticket (TGT) was requested checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.