Kerberos Ticket Option

[fluehmann 10]

Hallo zusammen

 

Eine Kerberos Frage zu Event ID 4769. Hier ein Beispiel:

 

A Kerberos service ticket was requested.

 

Account Information:

Account Name: Server.domain.ch

Account Domain: domain.ch

Logon GUID: {GUID}

 

Service Information:

Service Name: server

Service ID: domain\server

 

Network Information:

Client Address: IP

Client Port: Port

 

Additional Information:

Ticket Options: 0x40810000

Ticket Encryption Type: 0x17

Failure Code: 0x0

Transited Services: -

 

This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.

 

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

 

Ticket options, encryption types, and failure codes are defined in RFC 4120.

 

Es geht um die Additional Information. Die Failure Codes und Ticket Encryption Type ist mir klar. Jedoch finde ich keine Informationen die mir die Ticket Options erklären.

Was heisst denn Ticket Options:0x40810000?

Gibt es da eine Tabelle die das ganze aufzeigt?

 

Aus dem RFC 4120 bin ich nicht schlau geworden.

 

Gruss

fluehmann