Event 4768 is a Windows security audit event that records a request for a Kerberos ticket-granting ticket. It identifies the account being authenticated and whether the initial Kerberos logon request succeeded or failed, which makes it a core log for detecting authentication issues and suspicious account use.
What Event 4768 Captures
Event 4768 is the Kerberos ticket-granting ticket request audit record in Windows. It is one of the clearest signals that an account is attempting to authenticate against Active Directory, because it records whether the initial Kerberos logon request succeeded or failed.
Because it sits at the start of the Kerberos flow, Event 4768 helps answer a basic but important question: who is trying to get a ticket, from where, and whether the domain controller accepted the request. That makes it useful for separating routine authentication from suspicious or malformed activity.
Why Event 4768 Matters for Authentication Visibility
Event 4768 gives defenders visibility into the first step of Kerberos-based identity verification. When the event stream is healthy, it supports baselining of normal login behaviour, spot checks on service and user authentication patterns, and correlation with later ticket activity such as service ticket requests.
For operators who monitor Active Directory, it is most useful when read alongside related Kerberos events rather than in isolation. A single 4768 record may simply show a valid logon attempt, but patterns across many 4768 events can reveal password guessing, user enumeration, unusual logon sources, or account activity that does not match the expected workstation or service path.
What Analysts Look For In The Record
The fields in Event 4768 help an analyst understand the authentication context. The account name shows the subject of the request, while the success or failure outcome indicates whether the Kerberos pre-authentication step completed as expected. In practical terms, that means the event can support both incident triage and routine authentication review.
Analysts often use it to distinguish human user logons from service-driven activity, especially when they are trying to determine whether a burst of requests is legitimate automation or an authentication issue. It is also useful for identifying when the same account is being requested from multiple unexpected hosts or when failures cluster around a single principal.
Because Kerberos authentication is foundational to Windows domain access, the event becomes more valuable when the environment has strong logging coverage on domain controllers and a clear baseline for normal request volume. Without that baseline, the event still records activity, but it is harder to separate normal authentication noise from true anomalies.
How Event 4768 Supports Detection And Investigation
Event 4768 is often used as an early indicator during investigations of credential abuse, unusual account use, or domain authentication problems. It can help confirm whether a suspected account was actively requesting Kerberos tickets at the time an alert fired, and whether the request was accepted or rejected.
For defenders, the key value is correlation. A 4768 failure may point to a mistyped password, expired credentials, clock skew, or a more deliberate attempt to probe account validity. A 4768 success, followed by other suspicious domain activity, can help establish that an account was in active use before additional ticket or service access events appeared.
For a broader view of how 4768 fits into domain-controller telemetry, the Active Directory Security Monitoring and Event IDs Guide explains which audit settings and event IDs matter for Kerberos and related AD detections. For Kerberos-specific interpretation, the Kerberos Security Guide places 4768 in the wider authentication and ticketing lifecycle.
Risk and Threat Considerations
Event 4768 is valuable because attackers often touch Kerberos early, either by testing credentials, validating account existence, or using compromised identities to request tickets. When domain logging is weak or poorly reviewed, malicious authentication activity can blend into normal noise and delay detection.
Failure mechanism: Repeated failures, abnormal request sources, or unexpected success patterns can indicate password spraying, account probing, or the first stage of identity abuse before broader ticket-based activity becomes visible.
Impact: If those signals are missed, defenders may lose early warning of credential compromise, service-account misuse, or a larger Active Directory attack path that begins with authentication and ends in broader domain access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Event 4768 is an audit event that must be defined and collected as part of authentication monitoring. |
| AU-6 — Audit Record Review, Analysis, and Reporting | 4768 becomes useful when authentication logs are reviewed and correlated for anomalies. | |
| IA-2 — Identification and Authentication (Organizational Users) | 4768 records organizational-user authentication to a Windows domain service. | |
| Recommendation — Define and collect Kerberos authentication events needed to detect suspicious account use. Review authentication audit records for unusual account, source, and failure patterns. Use validated user authentication controls and monitor the resulting Kerberos log events. | ||
| MITRE ATT&CK | T1110 — Brute Force | Kerberos ticket requests and failures can reveal password-spraying and guessing activity. |
| T1558 — Steal or Forge Kerberos Tickets | 4768 is part of the Kerberos ticketing chain that adversaries abuse after or during compromise. | |
| Recommendation — Correlate repeated authentication failures with brute-force or password-spraying detections. Map suspicious Kerberos activity to ticket-abuse techniques and investigate adjacent ticket events. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org