I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request.
AgentDevice=WindowsLog AgentLogFile=Security PluginVersion=184.108.40.2063248 Source=Security Computer=DOMAINCONTROLLERHOSTNAME User=SYSTEM Domain=NT AUTHORITY EventID=672 EventIDCode=672 EventType=8 EventCategory=9 RecordNumber=95767528 TimeGenerated=1418246782 TimeWritten=1418246782 Level=0 Keywords=0 Task=0 Opcode=0 Message=Authentication Ticket Request: User Name: 1234567 Supplied Realm Name: MYREALM.COM User ID: DOMAIN\1234567 Service Name: krbtgt Service ID: MAPLE\krbtgt Ticket Options: 0x50800000 <------------- Result Code: - Ticket Encryption Type: 0x17 Pre-Authentication Type: 2 Client Address: 10.12.32.12 Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint:
I can't seem to find any documentation on it. Any ideas?