4773 A Kerberos service ticket request failed
A defined but never-generated event. A failed service-ticket request is recorded instead as a failure event of 4769.
Overview
The subcategory is Audit Kerberos Service Ticket Operations. As the original docs state, this event is defined but is not invoked or generated by the OS. When a TGS (service ticket) request fails, a failure (F) event of 4769 appears instead.
How it is triggered
- By definition, on a failed service-ticket request, but in practice it does not occur.
Security review points
- There is no need to make it a detection target. Monitor service-ticket requests, including Kerberoasting, via 4769.
Notes for log review
- It is effectively never recorded. For service-ticket failures, look at 4769.
Key fields
No specific fields carry practical meaning (since it is not generated).