I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request.
AgentDevice=WindowsLog
AgentLogFile=Security
PluginVersion=7.1.3.613248
Source=Security
Computer=DOMAINCONTROLLERHOSTNAME
User=SYSTEM
Domain=NT AUTHORITY
EventID=672
EventIDCode=672
EventType=8
EventCategory=9
RecordNumber=95767528
TimeGenerated=1418246782
TimeWritten=1418246782
Level=0
Keywords=0
Task=0
Opcode=0
Message=Authentication Ticket
Request:
User Name: 1234567
Supplied Realm Name: MYREALM.COM
User ID: DOMAIN\1234567
Service Name: krbtgt
Service ID: MAPLE\krbtgt
Ticket Options: 0x50800000 <-------------
Result Code: -
Ticket Encryption Type: 0x17
Pre-Authentication Type: 2
Client Address: 10.12.32.12
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
I can't seem to find any documentation on it. Any ideas?
Best Answer
RFC 4120 has your answer deep on page 74 and 75. It reads:
Following that is a list of the options available. There's other information in the RFC advising that some options aren't supported by older standards, etc.