2

I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request.

AgentDevice=WindowsLog
AgentLogFile=Security
PluginVersion=7.1.3.613248
Source=Security
Computer=DOMAINCONTROLLERHOSTNAME
User=SYSTEM
Domain=NT AUTHORITY
EventID=672
EventIDCode=672
EventType=8
EventCategory=9
RecordNumber=95767528
TimeGenerated=1418246782
TimeWritten=1418246782
Level=0
Keywords=0
Task=0
Opcode=0
Message=Authentication Ticket 
Request:
   User Name:  1234567
   Supplied Realm Name: MYREALM.COM
   User ID:   DOMAIN\1234567
   Service Name:  krbtgt
   Service ID:  MAPLE\krbtgt
   Ticket Options:  0x50800000   <-------------
   Result Code:  -
   Ticket Encryption Type: 0x17
   Pre-Authentication Type: 2
   Client Address:  10.12.32.12
   Certificate Issuer Name:
   Certificate Serial Number: 
   Certificate Thumbprint:

I can't seem to find any documentation on it. Any ideas?

1 Answer 1

2

RFC 4120 has your answer deep on page 74 and 75. It reads:

kdc-options This field appears in the KRB_AS_REQ and KRB_TGS_REQ requests to the KDC and indicates the flags that the client wants set on the tickets as well as other information that is to modify the behavior of the KDC. Where appropriate, the name of an option may be the same as the flag that is set by that option. Although in most cases, the bit in the options field will be the same as that in the flags field, this is not guaranteed, so it is not acceptable simply to copy the options field to the flags field. There are various checks that must be made before an option is honored anyway.

The kdc_options field is a bit-field, where the selected options are indicated by the bit being set (1), and the unselected options and reserved fields being reset (0).

Following that is a list of the options available. There's other information in the RFC advising that some options aren't supported by older standards, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .