This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi Team,
I have noticed a thousands of audit logs failure with Event ID:4768 with error "0x6" and username Host coming from our exchange servers to domain controllers:
A Kerberos authentication ticket (TGT) was requested.
Account Information:
Account Name: host
Supplied Realm Name: our domain
User ID: NULL SID
Service Information:
Service Name: krbtgt/our domain
Service ID: NULL SID
Network Information:
Client Address: ::ffff:( the IP of the exchange)
Client Port: 40486
Additional Information:
Ticket Options: 0x40810010
Result Code: 0x6
Ticket Encryption Type: 0xFFFFFFFF
Pre-Authentication Type: -
Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Certificate information is only provided if a certificate was used for pre-authentication.
Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
Note that we have exchange 2019 CU12
What cause this failure ?
Hi @Alaa Elrayes ，
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
If TGT issue fails then you will see Failure event with Result Code field not equal to “0x0” .
In general, when the result code equals "0x6", the reason is that the username does not exist or new computer/user account has not replicated to DC yet.
4768(S, F) A Kerberos authentication ticket (TGT) was requested. (Windows 10) | Microsoft Learn
However, according to my search, I found the following threads discussing this issue as well:
event id 4768 - Microsoft Q&A
Event ID 4768 (microsoft.com)
Moreover, I wonder if you installed any updates from the May or June 2022 on your server before you got such events?
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
I can't confirm on your wondering but what are the updates of May and June cause that issue to check if those installed or not ?
Thanks.
Hi,
Please refer to the following address to check if the May or June 2022 Windows update is installed on the domain controller:
“Control Panel – All Control Panel Items- Windows Update- View update history”.
If so, please compare whether the initial occurrence of event 4768 coincides with the time the update was installed.
I found those updates for May and June:
May 10, 2022-KB5013641 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server, version 2019
June 14, 2022-KB5013892 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server, version 2019
Are those the cause of issue ?
Hi,
Have you checked when Event4768 starts appearing?
Does it appear some time after installing these updates?
I searched for that event but I didn't find in that period of time.
Hi,
You can try uninstalling the windows update temporarily to see if the event persists.
Hi, @Aholic Liang-MSFT I have the same problem, it started to appear the day after the 2022-06 update on the domain controller. The update list from the control panel does not show it. Only the servicing stack update 10.0.17763.2980 with the same install date as the 2022-06 update is visible.
Any answer here ?
I am having the exact same issue but the error is between one exchange server and one DC. Any update to this issue would be great.
Thanks you
We are still having this same issue. Has anyone made any progress solving it? It is cluttering our audit logs.
Nope, same problem still. Packet tracing I've done MIGHT indicate this happens when the exchange server is communicating with M$/365, it seems that some authentication conversations right before data is sent/received triggers it. But I'm not sure here..