Windows Event ID 4769: A Kerberos service ticket was requested
- Applicable version
- Active Directory domain controllers running Windows Server 2008 or later; additional encryption fields depend on installed updates
- Last reviewed
- 2026-10-01
Quick summary
Windows Security Event ID 4769 records a Kerberos service-ticket request on a domain controller and is central to detecting anomalous service access and Kerberoasting patterns.
Technical Metadata
| Event ID | 4769 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success or Audit Failure |
| MITRE ATT&CK | TA0006 Credential Access / T1558.003 Kerberoasting |
| Key fields to watch | Account Name, Service Name, Client Address, Ticket Encryption Type |
Trigger Scenarios
The event is logged whenever a client requests a ticket for a service principal name. A normal user session may generate several requests as it accesses file servers, web applications, and other Kerberos-enabled services.
Key Fields
Account Name
The user or computer account requesting the service ticket. Assess whether the requester is expected to access the target service.
Service Name
ServiceName identifies the account or computer owning the requested service, not the full SPN. Distinct counts measure service accounts, not every SPN registered to them.
Client Address
The client IP address observed by the domain controller. It helps identify the source device conducting unusual service-ticket activity.
Ticket Encryption Type
The encryption type used for the service ticket. RC4 requests for service accounts can be relevant when investigating Kerberoasting exposure.
Threat Hunting Queries
SecurityEvent
| where EventID == 4769 and TicketEncryptionType == "0x17"
| summarize ServiceCount=dcount(ServiceName), Requests=count() by IpAddress, TargetAccount, bin(TimeGenerated, 1h)
| where ServiceCount > 20- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The 20-service value is an environment-specific starting threshold, not a Microsoft threshold. RC4 remains legitimate for documented legacy accounts; compare the service account's supported encryption types and available keys before escalating.
index=wineventlog source="WinEventLog:Security" EventCode=4769 TicketEncryptionType=0x17
| bin _time span=1h
| stats dc(ServiceName) as service_count count as requests by _time, IpAddress, TargetUserName
| where service_count > 20- Data source
- Splunk Windows Security event data
- Assumptions
- Field aliases vary by Splunk add-on and must be mapped to the Windows XML names. The service-count threshold must be baselined against application, backup, and monitoring accounts.
dataset = microsoft_windows_raw
| filter edr_event_id = 4769- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Domain controller Security logs are ingested into Cortex XDR. Inspect the raw TicketEncryptionType, ServiceName, IpAddress, and post-January-2025 supported-encryption fields because parsed raw-field names can vary by collection path.
title: RC4 Kerberos Service Ticket Request
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4769
TicketEncryptionType: '0x17'
condition: selection
falsepositives:
- Documented legacy services that do not yet support AES Kerberos keys
level: medium
tags:
- attack.credential-access
- attack.t1558.003- Data source
- Sigma Windows Security log source
- Assumptions
- An RC4 ticket is a candidate event, not proof of Kerberoasting; correlation and account encryption context are required.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| TicketOptions | 0x40810000 | Forwardable, Renewable, and Canonicalize flags are set. | A common option mask, not a Kerberoasting verdict. Correlate successful RC4 tickets and requester behavior. Source |
| TicketEncryptionType | 0x17 | RC4-HMAC was used for the issued service ticket. | RC4 service tickets are relevant to Kerberoasting triage because their encrypted material can be targeted for offline password cracking; legacy compatibility must be excluded. Source |
| TicketEncryptionType | 0x11 | AES128-CTS-HMAC-SHA1-96 was used for the service ticket. | Microsoft identifies AES-family 0x11 and 0x12 as expected ticket encryption values on modern Windows environments. Source |
| TicketEncryptionType | 0x12 | AES256-CTS-HMAC-SHA1-96 was used for the service ticket. | Use it with account supported-encryption fields to distinguish modern AES operation from unexpected RC4 fallback. Source |
| Status (Failure Code) | 0x20 | The service ticket has expired. | Microsoft describes this as a common informational failure with little or no security relevance, so it should not be treated as a high-priority Kerberos attack signal by itself. Source |
MITRE ATT&CK Mapping
- T1558.003Kerberoasting
Detection Notes
For T1558.003 Kerberoasting, hunt successful requests with Status 0x0 and TicketEncryptionType 0x17 (RC4-HMAC): issued service-ticket material can be attacked offline. RC4 is not proof of theft; compare ServiceSupportedEncryptionTypes and ServiceAvailableKeys when present, client-advertised types, and documented legacy dependencies. AES 0x11/0x12 is not immunity from Kerberoasting. More than 20 distinct ServiceName accounts per client in one hour is a locally tuned example, not a Microsoft threshold or a count of distinct SPNs. Validate the requester against application and backup baselines and correlate endpoint process activity. TicketOptions 0x40810000 is common normal behavior and must not trigger a verdict alone.
Common False Positives
- Application servers and middleware may request many service tickets during normal operation.
- Inventory, backup, and monitoring accounts often access broad sets of services.
- Legacy service accounts can legitimately use RC4 until the environment is remediated.
Related Events
Sample Log
Account Name: [email protected]
Service Name: svc_sql
Client Address: 10.x.x.x
Ticket Options: 0x40810000
Ticket Encryption Type: 0x12
Failure Code (XML Status): 0x0Frequently Asked Questions
What does Windows Event ID 4769 record?
Event ID 4769 records a Kerberos Ticket Granting Service request on a domain controller, including the requesting account, target service, client address, ticket options, encryption type, and success or failure information.
Does Ticket Encryption Type 0x17 prove Kerberoasting?
No. The value means RC4-HMAC was used and is relevant to Kerberoasting exposure, but legacy applications and accounts can legitimately require RC4; validate service-account keys, supported encryption types, request volume, and client behavior.
What do 4769 encryption values 0x17 and 0x12 mean?
In TicketEncryptionType, 0x17 means RC4-HMAC and 0x12 AES256; 0x11 is AES128. These are algorithm identifiers, not the msDS-SupportedEncryptionTypes bitmask. Compare supported types and available keys before treating RC4 as unexpected. AES tickets can still be targeted for Kerberoasting.
Is Event ID 4769 Service Name the complete SPN?
No. ServiceName names the service account or computer. One account can own multiple SPNs, so a distinct ServiceName count cannot enumerate every requested SPN. Use directory SPN registration and additional telemetry for service attribution.
Sources
- 4769(S, F): A Kerberos service ticket was requested
Microsoft · vendor
- Detect and remediate RC4 usage in Kerberos
Microsoft · vendor
- Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule