Event ID 4768 — Kerberos TGT Request
What does this event mean?
Event ID 4768 indicates that the Kerberos service on a domain controller received and processed a request for a Ticket Granting Ticket (TGT). A 4768 event can represent normal authentication; its meaning depends mainly on the result code and the associated fields.
Windows context / source
It is generated on a domain controller when Kerberos authentication-service auditing is enabled. Useful fields include the requested account, client address, Result Code, pre-authentication type, and the encryption types offered or used. A high volume of 4768 events is normal in an active Active Directory domain.
Common causes or situations
- Normal Kerberos sign-in or ticket renewal
- Incorrect password or Kerberos pre-authentication failure
- Unknown, disabled, expired, or restricted account
- Kerberos encryption-type mismatch or legacy configuration
- Unusual activity that requires correlation with other events
Diagnostic checks
- Read the Result Code and determine whether the request succeeded or failed.
- Identify the account, client IP address, and originating device.
- Review the pre-authentication type and encryption information when they are relevant to the failure.
- Correlate the timestamp and identity with Event ID 4771 for pre-authentication failures and with other relevant Kerberos events.
- Compare the request with the account’s normal activity to distinguish expected behavior from an anomaly.
Resolution
The corrective action depends on the Result Code. Check credentials and account status, system time and domain synchronization, DNS
Validation after action
Repeat the affected authentication and confirm that a new 4768 event reports the expected result. For an incident, also verify that related failure events no longer occur and that the user or service successfully obtains Kerberos tickets.