Ok so I am looking at some system logs and I have ran into multiple instances of event 4768. Like they pop up every 3-6 minutes. All logs started on the 16th of June and are ongoing.
I know that this particular code (4768) traces back to requesting a ticket via Kerberos Authentication (each time someone logs onto a workstation the event is logged as such).
What I want to know is when the event 4768 is paired with "Process ID 476" and " Kerberos Result 0x12" is this event dangerous and what can be done?
Notes: Windows Server 2008.
Generated under "Microsoft Windows Security Auditing"
Service ID: Null SID
I also have not seen a bunch of 4771 codes with the 0x18 error.