// REFERENCE
4770 — Kerberos service ticket renewed
Log: Security
Low risk
A service ticket was renewed. Usually routine; its value is completing the timeline of an account's Kerberos activity alongside 4768 and 4769.
Related tools
Work with this in:
Related
4768
4768 — Kerberos TGT requested (AS-REQ) 4769
4769 — Kerberos service ticket requested (TGS-REQ) 4771
4771 — Kerberos pre-authentication failed 4776
4776 — NTLM credential validation
4768 — Kerberos TGT requested (AS-REQ) 4769
4769 — Kerberos service ticket requested (TGS-REQ) 4771
4771 — Kerberos pre-authentication failed 4776
4776 — NTLM credential validation
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.