Windows Security Log Event ID 676

676: Authentication Ticket Request Failed

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event varies depending on the OS.

Win2000

W2k logs this event when the user's initial logon fails for other reasons than those reported by 675. See events 675 and 672 for explanation of the fields.

Win2003

W3 does not log this event. Instead W3 logs a failed instance of event 672.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 676

•  User Name: %1
•  Supplied Realm Name: %2
•  Service Name: %3
•  Ticket Options: %4
•  Failure Code: %5
•  Client Address: %6

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy