Event ID 4768: A Kerberos authentication ticket (TGT) was requested

Written on domain controllers when an account asks for a ticket-granting ticket, which is the first step of a Kerberos logon.

Why it matters

Pre-Authentication Type 0 means the account does not require pre-authentication, which makes it open to AS-REP roasting.
RC4 (0x17) ticket encryption where your domain uses AES can point to downgrade attacks or old tooling.
Failed requests show a Result Code, such as 0x6 for an unknown user or 0x18 for a wrong password.

Check Account Name, Client Address, Ticket Encryption Type, Pre-Authentication Type and Result Code.

Advanced Audit Policy on domain controllers: Account Logon > Audit Kerberos Authentication Service.

Code	Name	Meaning
0x6	KDC_ERR_C_PRINCIPAL_UNKNOWN	The user name does not exist.
0x12	KDC_ERR_CLIENT_REVOKED	The account is disabled, expired or locked out.
0x17	KDC_ERR_KEY_EXPIRED	The password has expired.
0x18	KDC_ERR_PREAUTH_FAILED	Wrong password.
0x25	KRB_AP_ERR_SKEW	Clocks on the client and domain controller are too far apart.
0xE	KDC_ERR_ETYPE_NOSUPP	The requested encryption type is not supported.

Code	Encryption	Note
0x11	AES128-CTS-HMAC-SHA1-96	Modern default.
0x12	AES256-CTS-HMAC-SHA1-96	Modern default.
0x17	RC4-HMAC	Legacy. Unexpected RC4 service tickets are a common Kerberoasting sign.
0x18	RC4-HMAC-EXP	Legacy.
0x1	DES-CBC-CRC	Obsolete; disabled by default since Windows 7 / Server 2008 R2.
0x3	DES-CBC-MD5	Obsolete; disabled by default since Windows 7 / Server 2008 R2.
0xFFFFFFFF	Failure	Shown on failed requests.