Event 4769: the encryption type is this ticket

The type belongs to this event

A 4769 on a domain controller records a service-ticket request. The Ticket Encryption Type field is the type logged for that ticket. One event’s value does not describe the next event, and it does not describe tickets you did not export.

Quote the field as printed, along with the service name and the account on that same event. A type without those is an incomplete citation.

The field is not a password result

Nothing in the encryption-type cell says a password was recovered, guessed, or changed. It also does not say the account can only use that type forever. Those claims need other records, and this page does not add a procedure for obtaining tickets.

If you have one event, write “one event.” Do not multiply it into a pattern.

What to write down

File the time, the record id if you have it, the account, the service name, and the encryption type. If you did not export other 4769 events for that account, say so before you describe “how this account requests tickets.”

Lab: one AES ticket read as the account’s only type

One lab 4769 shows account lab-user, service cifs/files, Ticket Encryption Type 0x12, at 09:14 UTC. No other 4769 rows were exported. A draft says the account only uses that type and that the password is therefore safe.

The note quotes this event’s type, service, and time. Other tickets were not in the export. The password is not judged from the field. The “only” and “safe” sentences are removed.

event: 4769
time: 09:14 UTC
account: lab-user
service: cifs/files
Ticket Encryption Type: 0x12
other 4769 rows exported: none
write: this ticket’s type
not: the account only uses this type, and not a password verdict