Windows Event ID 4770: A Kerberos service ticket was renewed
Windows Security Event ID 4770 records Ticket Granting Service ticket renewal on a domain controller.
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event is generated for every TGS renewal and only on domain controllers.
Key Fields
TargetUserName / TargetDomainName
UPN and Kerberos realm of the account requesting ticket renewal; computer accounts typically end with $.
ServiceName / ServiceSid
The service account or computer for which the renewed TGS is valid.
TicketOptions / TicketEncryptionType / IpAddress / IpPort
Microsoft documents TicketOptions values such as 0x40810010 and encryption types including 0x11 AES128, 0x12 AES256, and 0x17 RC4-HMAC; IpPort 0 indicates localhost.
Common False Positives
- Microsoft states this event is typically informational.
- Long-lived normal sessions renew Kerberos service tickets without user-visible activity.
Related Events
MITRE ATT&CK Mapping
- T1550.003Use Alternate Authentication Material: Pass the Ticket
Detection Notes
4770 is usually informational, but investigate renewals where TicketEncryptionType=0x17 in an AES-only domain, TicketOptions includes forwarded/renewable patterns such as 0x60810010, or IpAddress renews a privileged account from an unexpected host. Microsoft documents 0x17 as RC4-HMAC and 0x40810010/0x60810010 TicketOptions semantics; combined with unusual 4769/4624 activity this can support T1550.003 Pass the Ticket rather than normal ticket lifetime renewal.
SecurityEvent
| where EventID == 4770
| project TimeGenerated, Computer, Account, IpAddress, TicketOptions, TicketEncryptionType, ServiceNameindex=wineventlog EventCode=4770 | table _time, host, TargetUserName, IpAddress, TicketOptions, TicketEncryptionType, ServiceNameEventID: 4770
TargetUserName: [email protected]
ServiceName: cifs/fileserver
TicketOptions: 0x60810010
TicketEncryptionType: 0x17
IpAddress: ::ffff:10.0.0.12
IpPort: 49964