Windows Event ID 4768 – Microsoft-Windows-Security-Auditing: Kerberos Authentication Ticket (TGT) Requested

Start by examining the specific 4768 event details to understand the authentication context and identify any failure codes.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4768 using Filter Current Log
4. Double-click a 4768 event to view detailed information
5. Review key fields:
   • Account Name: The requesting user or service account
   • Account Domain: Domain of the requesting account
   • Client Address: IP address of the authentication request
   • Result Code: Success (0x0) or specific failure code
   • Ticket Encryption Type: Encryption method used
   • Pre-Authentication Type: Authentication method employed
6. For failed attempts, note the Failure Code and Sub Status values
7. Cross-reference the timestamp with user reports or system events

Use PowerShell to efficiently query and analyze 4768 events across multiple domain controllers or time periods.

1. Open PowerShell as Administrator on a domain controller
2. Query recent 4768 events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768} -MaxEvents 100 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter for failed authentication attempts:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768} | Where-Object {$_.Message -like '*0x*' -and $_.Message -notlike '*0x0*'} | Select-Object TimeCreated, Message

4. Search for specific user account activity:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=(Get-Date).AddHours(-24)}
   $Events | Where-Object {$_.Message -like '*AccountName*username*'} | Format-Table TimeCreated, Message -Wrap

5. Analyze authentication patterns by IP address:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=(Get-Date).AddDays(-1)}
   $Events | ForEach-Object { if($_.Message -match 'Client Address:\s+::ffff:([0-9.]+)') { $matches[1] } } | Group-Object | Sort-Object Count -Descending

6. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=(Get-Date).AddDays(-7)} | Export-Csv -Path "C:\Temp\Kerberos_TGT_Events.csv" -NoTypeInformation

Optimize Kerberos authentication logging by configuring advanced audit policies to capture the right level of detail without overwhelming the Security log.

1. Open Group Policy Management Console on a domain controller
2. Edit the Default Domain Controllers Policy or create a new GPO
3. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Expand Account Logon and configure:
   • Audit Kerberos Authentication Service: Enable Success and Failure
   • Audit Kerberos Service Ticket Operations: Enable as needed
5. Use PowerShell to verify current audit settings:

   auditpol /get /subcategory:"Kerberos Authentication Service"

6. Configure audit policy via command line if needed:

   auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable

7. Monitor Security log size and configure appropriate retention:

   Get-WinEvent -ListLog Security | Select-Object LogName, FileSize, MaximumSizeInBytes, RecordCount

8. Consider implementing log forwarding to a SIEM system for centralized analysis

Systematically diagnose and resolve common Kerberos authentication issues identified through 4768 event analysis.

1. Identify the specific failure code from the 4768 event details
2. Check time synchronization between client and domain controller:

   w32tm /query /status
   w32tm /resync /rediscover

3. Verify account status and properties:

   Get-ADUser -Identity username -Properties AccountLockoutTime, PasswordExpired, PasswordLastSet, LastLogonDate

4. Test Kerberos functionality from the client:

   klist purge
   klist tgt

5. Check supported encryption types:

   Get-ADUser -Identity username -Properties msDS-SupportedEncryptionTypes

6. Review Kerberos policy settings:

   Get-ADDefaultDomainPasswordPolicy
   Get-ADDomainController | Get-ADObject -Properties msDS-KrbTgtLinkBl

7. Validate DNS resolution for the domain controller:

   nslookup -type=SRV _kerberos._tcp.domain.com
   Test-NetConnection -ComputerName dc.domain.com -Port 88

8. Enable Kerberos logging for detailed troubleshooting:

   reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v LogLevel /t REG_DWORD /d 1 /f

Establish proactive monitoring of 4768 events to detect security threats and authentication anomalies in real-time.

1. Create a PowerShell script for continuous monitoring:

   # Monitor for suspicious authentication patterns
   $StartTime = (Get-Date).AddMinutes(-5)
   $FailedEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=$StartTime} | Where-Object {$_.Message -notlike '*0x0*'}
   
   if ($FailedEvents.Count -gt 10) {
       # Alert on high failure rate
       Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1001 -Message "High Kerberos failure rate detected: $($FailedEvents.Count) failures in 5 minutes"
   }

2. Set up Windows Task Scheduler to run the monitoring script every 5 minutes
3. Configure Event Viewer custom views for quick analysis:
   • Create a custom view filtering for Event ID 4768 with failure codes
   • Save the view as "Kerberos Authentication Failures"
4. Implement log forwarding using Windows Event Forwarding (WEF):

   # On collector server
   wecutil qc
   wecutil cs subscription.xml

5. Create subscription XML for 4768 events:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
     <SubscriptionId>KerberosAuth</SubscriptionId>
     <Query>
       <![CDATA[<QueryList><Query Id="0"><Select Path="Security">*[System[EventID=4768]]</Select></Query></QueryList>]]>
     </Query>
   </Subscription>

6. Monitor for specific attack patterns:
   • Multiple failures from single IP addresses
   • Authentication attempts for disabled accounts
   • Off-hours authentication for privileged accounts
   • Unusual encryption type requests
7. Integrate with SIEM solutions for advanced correlation and alerting