At a retailer, event 4768 records a Kerberos ticket-granting-ticket request for a store manager, and event 4769 records a service ticket for a file share that manager never uses. What do those two events support?
Select an answer to reveal the explanation.
Short Explanation
Two tickets from the same window, one for a room the guest never books, tell you where that guest asked to go. You have a ticket-granting ticket and then a service ticket for a share the manager never uses. The trap is a cleared audit log, a newly installed service, or a changed disk hash.
Full Explanation
Event 4768 records a Kerberos ticket-granting-ticket request, and event 4769 records a Kerberos service-ticket request. Together they support The manager account requested a ticket-granting ticket and a ticket for an unusual share. The security audit log was cleared, so later authentication events from this host are gone, is event 1102, and these two records are ticket requests, not a cleared log. A local service named Kerberos was installed, the event recorded when a service is added, would be event 7045, and 4768 and 4769 are ticket events rather than a service installation. The disk hash of the register changed, showing the file contents no longer match a baseline, is a file-integrity finding and is not what a TGT or a service ticket records. Exam caveat: a ticket-granting ticket can be a normal logon; the lead is the service ticket for a share the manager never uses, and neither event names the human holding the keyboard. Operational check: ask the manager whether they requested that share, and keep the client address recorded with the two ticket events.