AS Reply: The TGT

Why It Matters

Every later request rests on the TGT, which is sealed with a key only domain controllers hold. Whoever holds that krbtgt key can make TGTs for anyone, and whoever copies a TGT with its session key can use it until it expires.

Where It Sits

The strip shows every step of the Kerberos sign-in, with this page's step marked. Each of the others links to its own page, and Step Through It opens the walk-through on the topic page.

KerberosStep Through It

Step 1 of 6, AS Request, ws-017 to dc-01
Step 2 of 6, AS Reply, dc-01 to ws-017
Step 3 of 6, TGS Request, ws-017 to dc-01
Step 4 of 6, TGS Reply, dc-01 to ws-017
Step 5 of 6, AP Request, ws-017 to srv-fin-01
Step 6 of 6, AP Reply, srv-fin-01 to ws-017

What Happens

The TGT holds the account's name, its groups in the Privilege Attribute Certificate (PAC), the TGT session key and the validity times, all encrypted with the krbtgt key. The client can keep it and present it but never read or change it. The client's part of the reply holds the same session key and times, encrypted with the account's key, which is how the client learns the session key.

By default a TGT lasts ten hours and can be renewed for up to seven days, while members of Protected Users get four hours, never renewed beyond that. The client keeps the TGT and its session key in LSASS, unless Credential Guard isolates them, and uses them for every service ticket it asks for. The account's own key is not needed again until the client needs a new TGT.

The DC writes event 4768 to its Security log and keeps no other record of the TGTs it has issued. A later request is believed because its TGT opens with the krbtgt key, not because the DC remembers it, so a TGT forged with a stolen krbtgt key works as well as one the DC made. Resetting the krbtgt password twice, waiting at least the maximum ticket lifetime in between, stops such forgeries working.

What Is Sent

Each part of the message is listed with what it holds and what protects it. A part sealed with a key can be read only by whoever holds that key, and a part marked In the clear has no protection of its own.

Part	What It Holds	Protection and Who Can Read It
The TGT `ticket`	dana's name, her groups in the PAC, the TGT session key and its times, ten hours by default and renewable for seven days.	Encrypted with the krbtgt AES keyOnly dc-01 can open it.
ws-017's part `enc-part`	The same TGT session key, the times and the nonce from the request.	Encrypted with dana's AES keyOnly ws-017 and dc-01 can open it.

Reading Event 4768 After the January 2025 Updates

Event 4768 in the domain controller's Security log is the record of every TGT issued or refused. These are its fields as DCs with the January 2025 updates write them, and what each one tells you.

Field	What It Tells You
Account Name, Client Address	Which account asked, and the address the request came from.
Result Code	0x0 when a TGT was issued. The AS Request page lists the failures.
Pre-Authentication Type	2 for a password, 138 for an armoured sign-in, 15 or 16 for a certificate, 0 for none.
Pre-Authentication EncryptionType	The key form that made the timestamp, where 0x17 is the RC4 key, the account's NT hash.
Ticket Encryption Type	The TGT itself, sealed with the krbtgt key. It is normally 0x12, and never RC4 from a Windows Server 2025 DC.
Session Encryption Type	The TGT session key, in a type both sides support.
MSDS-SupportedEncryptionTypes, Available Keys	What the account supports and which keys it holds. Both are processed values, so read them together.
Response ticket hash	Identifies the TGT issued. In Microsoft's sample, a later event 4769 presenting that TGT shows the same value as its Request ticket hash.
Certificate Issuer Name, Certificate Serial Number, Certificate Thumbprint	Filled only when a certificate took the place of the password.

What Is Logged

Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.

Event and Log	Written On	Switch It On	What It Tells You
4768 `A Kerberos authentication ticket (TGT) was requested` (opens in a new tab) Security log	Domain controllers	Audit Kerberos Authentication Service	Account Name dana, Client Address ::ffff:192.0.2.17, Result Code 0x0, Pre-Authentication Type 2. Pre-Authentication EncryptionType 0x12 is the type of her timestamp, and Ticket Encryption Type 0x12 is the type of the TGT itself.

Check It on a Machine

These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

AS-REP Roasting
Asks for a TGT for an account that skips pre-authentication, then guesses offline.
At This Step This reply has a part sealed with the account's key. Without pre-authentication anyone can get it, and that part can be guessed offline.
Golden Ticket
Forges a TGT with the krbtgt key, for any account and groups, that every DC accepts.
At This Step A golden ticket skips this reply, as its TGT is made offline with the krbtgt key, so no 4768, the record of a TGT issued, sits behind it.
Diamond and Sapphire Tickets
Alters a real TGT with the krbtgt key, so a genuine sign-in sits behind the forgery.
At This Step It begins as a real TGT from this reply, opened with the krbtgt key and its group list (the PAC) changed or swapped, so its 4768 is real.
Pass-the-Ticket
Replays a Kerberos ticket copied from one machine's memory on another.
At This Step This reply's TGT and session key sit in LSASS on ws-017. Unless Credential Guard isolates them, a copy works elsewhere until they expire.
NTDS.dit Theft
Copies a domain controller's database to read every account's keys, krbtgt's included.