I've been receiving a lot of Auditing events for 4769 on our Win2k8 DC and researched the problem. We used the following command to turn off the events as they were messing with our other security solutions:
1.) auditpol /get /category:"Account Logon" /subcategory:"Kerberos Service Ticket Operations"
Result: We see it is set for "Success and Failure".
2.) We set the flag for JUST success:
auditpol /set /category:"Account Logon" /subcategory:"Kerberos Service Ticket Operations" /failure:disable
Result: As expected Setting only shows "Success".
This works great for a 5-7 hours, but somehow it flips back throughout the night and we start getting a flood of these messages again. There are NO other corresponding events in the Event Manager that would explain this flag being reset.