673: Service Ticket Granted

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event
• Mini-seminars on this event

This event varies depending on the OS.

Win2000

Whereas event ID 672 lets you track initial logons through the granting of TGTs, this lets you monitor the granting of service tickets. Service tickets are obtained whenever a user or computer accesses a server on the network. For example, when a user maps a drive to a file server, the resulting service ticket request generates event ID 673 on the DC.

User Name and User Domain identify the user.
Service Name corresponds the computer name of the server the user accessed.
Client Address specifies the IP address where the user resides.

Win2003

W3 uses this event ID for both successful and failed service ticket requests.

Whereas event ID 672 lets you track initial logons through the granting of TGTs, this lets you monitor the granting of service tickets. Service tickets are obtained whenever a user or computer accesses a server on the network. For example, when a user maps a drive to a file server, the resulting service ticket request generates event ID 673 on the DC.

User Name and User Domain identify the user.
Service Name corresponds the computer name of the server the user accessed.
Client Address specifies the IP address where the user resides.

The reason for a failed service ticket request is specified in Failure Code.

This event is logged only on domain controllers.

Description Fields in 673  User Name:  %1  User Domain:  %2  Service Name:  %3  Service ID:  %4  Ticket Options:  %5  Ticket Encryption Type: %6  Client Address:  %7  Failure Code:  %8  Logon GUID:  %9  Transited Services: %10 Top 10 Windows Security Events to Monitor Examples of 673 Win2000 Service Ticket Granted User Name: %1 User Domain: %2 Service Name: %3 Service ID: %4 Ticket Options: %5 Ticket Encryption Type: %6 Client Address: %7 Win2003 Service Ticket Request: User Name: User Domain:SERVER.APPLEADV.COM Service Name:host/server1.server.appleadv.com Service ID:- Ticket Options:0x40830000 Ticket Encryption Type:- Client Address:127.0.0.1 Failure Code:0xD Logon GUID:- Transited Services:- Keep me up-to-date on the Windows Security Log. Email*: *We will NOT share this

Training for the Windows Security Log

Discussions on Event ID 673 • EventClassID 673 Bad Options error messages

 

Upcoming Webinars 3 Ways Two-Factor Authentication Can Stop APTs from Spreading Understanding the Security Boundaries and Risks of Multiple Domains, Forests and Trust Relationships 6 Steps to Classifying Your Data Top 6 Security Events to Monitor in SQL Server Top 10 Security Events to Monitor in SharePoint

Additional Resources Security Log Quick Reference Chart Learn about the SharePoint Audit Log Patch Tuesday Analysis

•	All Event IDs
•	Audit Policy