Event ID 4768 with error "0x6"

Question

Event ID 4768 with error "0x6"

Alaa Elrayes 11

Hi Team,

I have noticed a thousands of audit logs failure with Event ID:4768 with error "0x6" and username Host coming from our exchange servers to domain controllers:

A Kerberos authentication ticket (TGT) was requested.

Account Information:
Account Name: host
Supplied Realm Name: our domain
User ID: NULL SID

Service Information:
Service Name: krbtgt/our domain
Service ID: NULL SID

Network Information:
Client Address: ::ffff:( the IP of the exchange)
Client Port: 40486

Additional Information:
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: 0xFFFFFFFF
Pre-Authentication Type: -

Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Note that we have exchange 2019 CU12

What cause this failure ?

Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2022-11-25T07:12:58.99+00:00

Hi @Alaa Elrayes ，
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
If TGT issue fails then you will see Failure event with Result Code field not equal to “0x0” .
In general, when the result code equals "0x6", the reason is that the username does not exist or new computer/user account has not replicated to DC yet.

4768(S, F) A Kerberos authentication ticket (TGT) was requested. (Windows 10) | Microsoft Learn

However, according to my search, I found the following threads discussing this issue as well:
event id 4768 - Microsoft Q&A
Event ID 4768 (microsoft.com)
Moreover, I wonder if you installed any updates from the May or June 2022 on your server before you got such events?

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Jeff Poblocki 26 Reputation points

2023-01-05T20:37:49.33+00:00

We are still having this same issue. Has anyone made any progress solving it? It is cluttering our audit logs.
Raymond Hellberg 1 Reputation point

2023-01-11T19:00:50.9133333+00:00

Nope, same problem still. Packet tracing I've done MIGHT indicate this happens when the exchange server is communicating with M$/365, it seems that some authentication conversations right before data is sent/received triggers it. But I'm not sure here..

2 answers

Your answer

Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2022-11-25T07:12:58.99+00:00

Hi @Alaa Elrayes ，
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
If TGT issue fails then you will see Failure event with Result Code field not equal to “0x0” .
In general, when the result code equals "0x6", the reason is that the username does not exist or new computer/user account has not replicated to DC yet.

4768(S, F) A Kerberos authentication ticket (TGT) was requested. (Windows 10) | Microsoft Learn

However, according to my search, I found the following threads discussing this issue as well:
event id 4768 - Microsoft Q&A
Event ID 4768 (microsoft.com)
Moreover, I wonder if you installed any updates from the May or June 2022 on your server before you got such events?

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Jeff Poblocki 26 Reputation points

2023-01-05T20:37:49.33+00:00

We are still having this same issue. Has anyone made any progress solving it? It is cluttering our audit logs.
Raymond Hellberg 1 Reputation point

2023-01-11T19:00:50.9133333+00:00

Nope, same problem still. Packet tracing I've done MIGHT indicate this happens when the exchange server is communicating with M$/365, it seems that some authentication conversations right before data is sent/received triggers it. But I'm not sure here..

Answer 1

Alaa Elrayes 11

Hi @Aholic Liang-MSFT

I can't confirm on your wondering but what are the updates of May and June cause that issue to check if those installed or not ?

Thanks.

Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2022-11-30T06:54:27.257+00:00

Hi,
Please refer to the following address to check if the May or June 2022 Windows update is installed on the domain controller:
“Control Panel – All Control Panel Items- Windows Update- View update history”.
If so, please compare whether the initial occurrence of event 4768 coincides with the time the update was installed.
Alaa Elrayes 11 Reputation points

2022-12-01T12:33:29.08+00:00

I found those updates for May and June:

May 10, 2022-KB5013641 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server, version 2019
June 14, 2022-KB5013892 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server, version 2019

Are those the cause of issue ?
Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2022-12-02T07:55:19.34+00:00

Hi,
Have you checked when Event4768 starts appearing?
Does it appear some time after installing these updates?
Alaa Elrayes 11 Reputation points

2022-12-05T14:10:17.843+00:00

I searched for that event but I didn't find in that period of time.
Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2022-12-09T05:45:57.437+00:00

Hi,
You can try uninstalling the windows update temporarily to see if the event persists.
Goat164 1 Reputation point

2022-12-13T09:48:53.783+00:00

Hi, @Aholic Liang-MSFT I have the same problem, it started to appear the day after the 2022-06 update on the domain controller. The update list from the control panel does not show it. Only the servicing stack update 10.0.17763.2980 with the same install date as the 2022-06 update is visible.

Answer 2

Alaa Elrayes 11

Any answer here ?

William Fulmer 16 Reputation points

2023-02-10T14:36:47.91+00:00
@Alaa Elrayes @Alaa Elrayes Any update to your issue? Have you uncovered where these requests are originating?
Paul Egan 0 Reputation points

2023-02-21T13:39:29.9566667+00:00

I am having the exact same issue but the error is between one exchange server and one DC. Any update to this issue would be great.

Thanks you

Share via

Event ID 4768 with error "0x6"

2 answers

Your answer