Skip to main content
AD Academy
Back to all events
4768Security (DC)AuthenticationINFOLast updated:

A Kerberos TGT was requested

What it means

Start of Kerberos authentication. Watch Ticket Encryption Type: 0x17 (RC4) on a modern account can mean downgrade or AS-REP Roasting.

When it is normal and when it is suspicious

Normal: one TGT per morning logon. Suspicious: TGT requests for many accounts from one host in a short window.

First steps

  1. 1Filter on Encryption Type 0x17 to spot accounts without pre-auth.
  2. 2Check the "Do not require Kerberos preauthentication" flag.

Fields worth checking

FieldWhat to look at
Pre-Authentication TypeValue 0 = no pre-auth → the account is exposed to AS-REP roasting.
Ticket Encryption Type0x17 (RC4) instead of 0x12 (AES) means weak crypto, sometimes an attack signal.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.