Audit Kerberos Authentication Service
Some detection rules require monitoring Kerberos ticket-granting ticket (TGT) requests to identify unusual or potentially malicious authentication activity. This audit policy applies exclusively to Domain Controllers, as other systems do not produce these events.
To enable Audit Kerberos Authentication Service on all Domain Controllers via Group Policy, administrators must enable the Audit Kerberos Authentication Service policy. Follow these steps to configure the audit policy via Advanced Audit Policies Configuration:
Computer Configuration >
Policies >
Windows Settings >
Security Settings >
Advanced Audit Policies Configuration >
Audit Policies >
Account Logon >
Audit Kerberos Authentication Service (Success,Failure)
To enable this policy on a local Domain Controller, run the following command in an elevated command prompt:
auditpol.exe /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
When this audit policy is enabled, the following event IDs may be generated:
- 4768: A Kerberos authentication ticket (TGT) was requested.
- 4771: Kerberos pre-authentication failed.
- 4772: A Kerberos authentication ticket request failed.
Use the following GitHub search to identify rules that use the events listed: