Event ID 4769: A Kerberos service ticket was requested

Written on domain controllers when an account asks for a ticket to a specific service, such as a file server or SQL Server.

Why it matters

Kerberoasting shows up as one account requesting tickets for many services in a short time, often with RC4 (0x17) encryption.
Requests for krbtgt or for services that do not usually get traffic deserve a closer look.
Very high volume: filter out machine accounts and expected service traffic first.

Count distinct Service Names per Account Name over a short window, and check Ticket Encryption Type and Client Address.

Advanced Audit Policy on domain controllers: Account Logon > Audit Kerberos Service Ticket Operations.

Code	Name	Meaning
0x6	KDC_ERR_C_PRINCIPAL_UNKNOWN	The user name does not exist.
0x12	KDC_ERR_CLIENT_REVOKED	The account is disabled, expired or locked out.
0x17	KDC_ERR_KEY_EXPIRED	The password has expired.
0x18	KDC_ERR_PREAUTH_FAILED	Wrong password.
0x25	KRB_AP_ERR_SKEW	Clocks on the client and domain controller are too far apart.
0xE	KDC_ERR_ETYPE_NOSUPP	The requested encryption type is not supported.

Code	Encryption	Note
0x11	AES128-CTS-HMAC-SHA1-96	Modern default.
0x12	AES256-CTS-HMAC-SHA1-96	Modern default.
0x17	RC4-HMAC	Legacy. Unexpected RC4 service tickets are a common Kerberoasting sign.
0x18	RC4-HMAC-EXP	Legacy.
0x1	DES-CBC-CRC	Obsolete; disabled by default since Windows 7 / Server 2008 R2.
0x3	DES-CBC-MD5	Obsolete; disabled by default since Windows 7 / Server 2008 R2.
0xFFFFFFFF	Failure	Shown on failed requests.