Getting 4768 error from username "host" a few times everyday

Question

I am getting this 4678 (F) event ID several times a day and occurring everyday in one DC among 4.

The accountname shows "host" (we don't have any object with this name)

I don't have any Task Schedular running, it started on the same day I have installed Patches for August 2024. But I have 4 DCs, only 1 DC reporting this.

The Process ID in the XML details refers to lsaas.exe which I can see from the taskManager details tab.

Does anyone have any idea what could be the issue?

Here is the xml details of the ID

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 9/10/2024 4:30:23 AM

Event ID: 4768

Task Category: Kerberos Authentication Service

Level: Information

Keywords: Audit Failure

User: N/A

Computer: DC01.corp.abc.com

Description:

A Kerberos authentication ticket (TGT) was requested.

Account Information:

*Account Name:		host*

*Supplied Realm Name:	corp.abc.com*

*User ID:			NULL SID*

Service Information:

*Service Name:		krbtgt/corp.abc.com*

*Service ID:		NULL SID*

Network Information:

*Client Address:		::1*

*Client Port:		0*

Additional Information:

*Ticket Options:		0x40810010*

*Result Code:		0x6*

*Ticket Encryption Type:	0xFFFFFFFF*

*Pre-Authentication Type:	-*

Certificate Information:

*Certificate Issuer Name:*		

*Certificate Serial Number:*	

*Certificate Thumbprint:*		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

*<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />*

*<EventID>4768</EventID>*

*<Version>0</Version>*

*<Level>0</Level>*

*<Task>14339</Task>*

*<Opcode>0</Opcode>*

*<Keywords>0x8010000000000000</Keywords>*

*<TimeCreated SystemTime="2024-09-10T00:30:23.947713100Z" />*

*<EventRecordID>198123582</EventRecordID>*

*<Correlation />*

*<Execution ProcessID="780" ThreadID="460" />*

*<Channel>Security</Channel>*

*<Computer>DC01.corp.abc.com</Computer>*

*<Security />*

</System>

<EventData>

*<Data Name="TargetUserName">host</Data>*

*<Data Name="TargetDomainName">corp.abc.com</Data>*

*<Data Name="TargetSid">S-1-0-0</Data>*

*<Data Name="ServiceName">krbtgt/corp.abc.com</Data>*

*<Data Name="ServiceSid">S-1-0-0</Data>*

*<Data Name="TicketOptions">0x40810010</Data>*

*<Data Name="Status">0x6</Data>*

*<Data Name="TicketEncryptionType">0xffffffff</Data>*

*<Data Name="PreAuthType">-</Data>*

*<Data Name="IpAddress">::1</Data>*

*<Data Name="IpPort">0</Data>*

*<Data Name="CertIssuerName">*

*</Data>*

*<Data Name="CertSerialNumber">*

*</Data>*

*<Data Name="CertThumbprint">*

*</Data>*

</EventData>

</Event>

Answer 1

Hello ADRookie,

Thank you for posting in Q&A forum.

Event 4768 is generated every time the Key Distribution Center (KDC) attempts to validate credentials. When the result code equals "0x6", it indicates that the username doesn't exist or the new computer/user account has not replicated to the domain controller yet.

1. If you want to know which thread raise the ticket for not exist user, you could use Process monitor. Process Monitor - Sysinternals | Microsoft Learn
2. If you have recently installed updates, it might have caused this issue. Please consider rolling back and check if the issue consists.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.