ZEKASTRA

SecurityKerberos and NTLM authentication

4769 · A Kerberos service ticket was requested

Generated on domain controllers every time the KDC receives a request for a service ticket (TGS). Failures carry a non-zero Status.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • ServiceName
  • ServiceSid
  • TicketOptions
  • TicketEncryptionType
  • IpAddress
  • IpPort
  • Status
  • LogonGuid
  • TransmittedServices

02How to use it

Shows which services an account requested access to and from where. Many requests for different service accounts with RC4 encryption from one client can indicate ticket harvesting for offline password cracking.

03Caveats

Requires Audit Kerberos Service Ticket Operations; the volume is high in most domains. Status 0x20 (ticket expired) is common and mostly informational.

05Sources

  1. Microsoft Learn — 4769(S, F) A Kerberos service ticket was requested checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.