SOC Event Lookup
Event ID 4768KerberosP1

Windows Event ID 4768: A Kerberos authentication ticket (TGT) was requested

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4768 records a Kerberos ticket-granting ticket (TGT) request handled by a domain controller. Its Pre-Authentication Type is the primary log-based signal for AS-REP Roasting.

Technical Metadata

Technical metadata for Event ID 4768
Event ID4768
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success or Audit Failure
MITRE ATT&CKTA0006 Credential Access / T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
Key fields to watchPre-Authentication Type, Ticket Encryption Type, Account Name, Failure Code

Trigger Scenarios

A domain controller logs the event on every TGT request, whether it succeeds, fails pre-authentication, or is rejected for policy reasons such as an unknown principal or disabled account.

Key Fields

Pre-Authentication Type

A value of 0 means the KDC issued a TGT without encrypted-timestamp pre-authentication. This occurs only when the account has the 'Do not require Kerberos preauthentication' flag and is the exact condition AS-REP Roasting uses.

Ticket Encryption Type

0x11 and 0x12 are AES128 and AES256; 0x17 is RC4-HMAC; 0x1 and 0x3 are legacy DES. RC4 is cheaper to crack offline, while DES should not appear in a hardened domain.

Account Name

The principal requesting the TGT. Compare privileged, service, and dormant accounts with the reviewed preauthentication-exception list.

Failure Code

0x6 (KDC_ERR_C_PRINCIPAL_UNKNOWN) against many accounts from one source indicates username enumeration or a password-spray precursor.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4768
SecurityEvent
| where EventID == 4768
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4768
index=wineventlog source="WinEventLog:Security" EventCode=4768
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4768
dataset = microsoft_windows_raw
| filter edr_event_id = 4768
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4768
title: Windows Security Event ID 4768
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4768
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
PreAuthType0No Kerberos preauthentication data was supplied for the ticket request.For an account configured not to require preauthentication, an unauthenticated requester can obtain material for offline AS-REP password cracking. Source
TicketEncryptionType0x17RC4-HMAC was used for the ticket.RC4 is weaker than AES for offline cracking resistance; review it in environments that expect AES, but account and client compatibility must be considered. Source
ResultCode0x6The requested client account was not found in the Kerberos database.A burst across many names from one client can support account-enumeration triage, but it is not by itself evidence of password spraying. Source

MITRE ATT&CK Mapping

  • T1558.004Steal or Forge Kerberos Tickets: AS-REP Roasting

Detection Notes

PreAuthType 0 for an account outside the reviewed exception list makes T1558.004 AS-REP Roasting possible because a requester can obtain material for offline password cracking without proving knowledge of the password. In an AES-only domain, TicketEncryptionType 0x17 RC4 is an additional compatibility deviation. A burst of ResultCode 0x6 across distinct account names from one client supports account-enumeration triage, not a password-spraying verdict, because the named principal was not found.

Common False Positives

  • A small, documented set of legacy service accounts can have preauthentication disabled for compatibility.
  • Normal workstation logons and service restarts generate high volumes of fully pre-authenticated 4768 events.
  • VPN reconnects and expired cached tickets can create expected bursts.

Related Events

Sample Log

Sanitized event sample
Account Name: [email protected]
Client Address: 10.x.x.x
Ticket Encryption Type: 0x17
Pre-Authentication Type: 0
Failure Code: 0x0

Frequently Asked Questions

What does Windows Event ID 4768 mean?

Event ID 4768 records a Kerberos authentication service request for a ticket-granting ticket and can represent either a successful or failed request.

Which 4768 value is associated with AS-REP roasting?

PreAuthType 0 means no preauthentication data was supplied; risk arises when the target account is configured to allow ticket requests without Kerberos preauthentication.

Does TicketEncryptionType 0x17 prove an attack?

No. It identifies RC4-HMAC and can occur for compatibility reasons; it becomes more useful when the domain expects AES or when combined with suspicious accounts, sources, and preauthentication settings.

Sources