Windows Security Log Event ID 674

674: Ticket Granted Renewed

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event varies depending on the OS.

Win2000

Kerberos limits how long a ticket is valid. If a ticket expires when the user is still logged on, Win2K automatically contacts the DC to renew the ticket which triggers this event. See event 673 for an explanation of the fields.

Win2003

Kerberos limits how long a ticket is valid. If a ticket expires when the user is still logged on, Win2K automatically contacts the DC to renew the ticket which triggers this event. See event 673 for an explanation of the fields.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 674

•  User Name: %1
•  User Domain: %2
•  Service Name: %3
•  Service ID: %4
•  Ticket Options: %5
•  Ticket Encryption Type: %6
•  Client Address: %7

Supercharger Enterprise

 

Mini-Seminars Covering Event ID 674 Security Log Exposed: What is the Difference Between “Account Logon” and “Logon/Logoff” Events?

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy