Windows event log ยท Security4772 A Kerberos authentication ticket request failed
Per Microsoft, currently this event doesn't generate. It is a defined event, but it is never invoked by the operating system. 4769 failure event is generated instead.
- Security
- 1 field
Security.evtxMicrosoft-Windows-Security-Auditing
Notes
- Per Microsoft, currently this event doesn't generate. It is a defined event, but it is never invoked by the operating system. 4769 failure event is generated instead.
- This map is in place in case this event does come across in logs so the Map Description field will be populated.
Fields EvtxECmd extracts
1 column in the EvtxECmd CSV
- PayloadData1
Target: %TargetUserName%- %TargetUserName% = /Event/EventData/Data[@Name="TargetUserName"]
References
3 links
- ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4772(opens in new tab)
- docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4772(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv(opens in new tab)
Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4772.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)