Privilege, Lockout & Kerberos

What is it?

4672 marks a logon that was granted special (admin) privileges. 4740 is an account lockout. Kerberos events 4768 (TGT), 4769 (service ticket) and 4771 (pre-auth failed) trace domain authentication.

Why it matters

4672 tells you a session is privileged (higher stakes); 4740 explains a locked-out user (attack or a stuck credential); Kerberos events reveal domain attacks like Kerberoasting (a burst of 4769 with RC4).

Where you see it

4672 alongside a 4624 for an admin; 4740 naming the locked account and the caller computer; 4769 rows with a service name and encryption type.

What normal looks like

4672 for expected admins, the odd 4740 from a forgotten password, steady Kerberos ticketing.

What suspicious looks like

4672 for an account that should never be admin, repeated 4740 across many accounts (spray fallout), or a burst of 4769 with RC4 (Kerberoasting).

How analysts investigate

Pair 4672 with the account to judge privilege, use 4740 to explain lockouts and find the source, and watch 4769 volume/encryption for ticket-based attacks.

Common beginner mistakes

Ignoring 4672 — you miss that a compromised session had admin rights.
Treating every 4740 lockout as an attack without checking the source.

Privilege and tickets

  4624 + 4672  account=svc-web  → this logon has ADMIN privileges (high stakes)
  4740  account=j.rai  caller=WIN-KIOSK  → lockout; find WHY on that host
  4769 x40  RC4 encryption  many service names  → Kerberoasting pattern
  read the ID WITH the account and the fields, never alone

4672 flags privilege, 4740 explains lockouts, and 4769 volume/encryption reveals Kerberos attacks.

Quick check

You see a 4672 for a normal user account that should never have admin rights. Significance?

A quick self-check — it doesn't affect your XP or progress.