Windows Event ID 4769 – Microsoft-Windows-Security-Auditing: Kerberos Service Ticket Requested

Start by examining the specific 4769 event details to understand the authentication context.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4769 using Filter Current Log
3. Double-click a recent 4769 event to view details
4. Key fields to examine:
   • Account Name: User or service account making the request
   • Service Name: Target service being accessed
   • Client Address: Source IP of the authentication request
   • Failure Code: 0x0 for success, other codes indicate specific failures
   • Ticket Options: Kerberos flags and encryption types
5. Note the timestamp and frequency of events from the same account

Use this PowerShell command to quickly extract recent 4769 events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='Account';Expression={$_.Properties[0].Value}}, @{Name='ServiceName';Expression={$_.Properties[1].Value}}

Use PowerShell to identify unusual authentication patterns or potential security issues.

1. Extract and analyze 4769 events for suspicious activity:

# Get failed Kerberos service ticket requests
$FailedAuth = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} -MaxEvents 1000 | Where-Object {$_.Properties[8].Value -ne '0x0'}

# Group by account to identify accounts with high failure rates
$FailedAuth | Group-Object {$_.Properties[0].Value} | Sort-Object Count -Descending | Select-Object Name, Count

# Check for unusual service access patterns
$ServiceTickets = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} -MaxEvents 500
$ServiceTickets | Group-Object {$_.Properties[1].Value} | Sort-Object Count -Descending | Select-Object Name, Count

2. Look for these suspicious patterns:
   • High volumes of failed requests from single accounts
   • Unusual service access outside normal business hours
   • Service ticket requests for sensitive services from unexpected accounts
   • Rapid-fire authentication attempts indicating automated attacks
3. Cross-reference with Event ID 4768 (TGT requests) for complete authentication flow

Optimize Kerberos auditing settings to capture relevant events while managing log volume.

1. Open Group Policy Management Console and navigate to the domain controller OU
2. Edit the Default Domain Controllers Policy
3. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Configure Audit Kerberos Service Ticket Operations:
   • Success: Enable for normal authentication tracking
   • Failure: Enable for security monitoring
5. Use PowerShell to configure audit settings programmatically:

# Enable Kerberos service ticket auditing
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable

# Verify current audit settings
auditpol /get /subcategory:"Kerberos Service Ticket Operations"

6. Consider enabling Audit Kerberos Authentication Service for comprehensive Kerberos monitoring
7. Apply policy and run gpupdate /force on domain controllers

Resolve SPN-related authentication failures that generate 4769 error events.

1. Identify SPN-related failures by checking failure codes in 4769 events
2. Common SPN failure codes:
   • 0x7: KDC_ERR_S_PRINCIPAL_UNKNOWN (SPN not found)
   • 0x25: KDC_ERR_INTEGRITY (encryption/integrity failure)
3. Use setspn to diagnose SPN issues:

# List all SPNs for a service account
setspn -L DOMAIN\ServiceAccount

# Check for duplicate SPNs across the domain
setspn -X

# Find SPNs registered to a specific service
setspn -Q HTTP/webserver.domain.com

4. Resolve SPN issues:
   • Register missing SPNs: setspn -A HTTP/server.domain.com DOMAIN\ServiceAccount
   • Remove duplicate SPNs: setspn -D HTTP/server.domain.com DOMAIN\WrongAccount
5. Verify SPN resolution using:

# Test Kerberos authentication to a specific service
klist get HTTP/webserver.domain.com

# Clear Kerberos ticket cache if needed
klist purge

Set up automated monitoring for 4769 events to detect security threats and authentication issues.

1. Create custom Event Viewer views for security monitoring:
2. In Event Viewer, right-click Custom Views → Create Custom View
3. Configure filter criteria:
   • Event logs: Security
   • Event IDs: 4769
   • Keywords: Audit Failure (for failed authentications)
4. Use PowerShell to create automated monitoring scripts:

# Monitor for Kerberoasting attempts (RC4 encryption requests)
$KerberoastingEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} -MaxEvents 100 | Where-Object {
    $_.Properties[7].Value -match '0x17' # RC4-HMAC encryption
}

# Alert on high-volume authentication from single source
$RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769; StartTime=(Get-Date).AddHours(-1)}
$HighVolumeIPs = $RecentEvents | Group-Object {$_.Properties[6].Value} | Where-Object {$_.Count -gt 100}

if ($HighVolumeIPs) {
    Write-Warning "High volume Kerberos requests detected from: $($HighVolumeIPs.Name -join ', ')"
}

5. Configure Windows Event Forwarding (WEF) to centralize 4769 events:
6. On collector server, enable WinRM: winrm quickconfig
7. Create subscription for 4769 events from domain controllers
8. Integrate with SIEM solutions like Microsoft Sentinel or Splunk for advanced analytics