This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120.
Windows Server 2012NetworkingActive DirectoryDNSWindows Server 2008
Event ID 4769 is a Kerberos Ticket Signing request when an account (user or computer) tries to request access to resources. In particular you are interested in the failure code which is 0xE which is the hex code for KDC_ERR_ETYPE_NOTSUPP or KDC has no support for encryption type. I suspect DESKTOP123 is running an old operating system like say Windows XP (burn it with fire!). Windows XP was designed to work with Server 2003, it does not have support for newer enhancements to Kerberos that Server 2008 and on have so you get initial failures. The fix, remediate your fleet and get rid of older operating systems like Windows XP, Server 2003, etc. I would not recommend turning off your security auditing.
Alternatively, if you cannot or will not remove older clients I would say just learn to live with the errors.
dreamer123456
ASKER
Hi,
These are windows 10 pro workstations. I am also seeing lot of these errors from domain user logins in middle of night when no users are using the computers. I am seeing hundreds of these failures every hour. I scanned with trendmicro and nothing was detected.
If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.
Alternatively, if you cannot or will not remove older clients I would say just learn to live with the errors.