Windows Event ID 4713 — Kerberos policy was changed

Kerberos policy settings were changed. Includes ticket lifetime, renewal lifetime, and other Kerberos parameters.

Why event 4713 matters

Extending Kerberos ticket lifetime to support long-lived Golden Tickets or to avoid ticket expiry during prolonged attacks. Also reducing maximum ticket lifetime for attackers who want to prevent detection via unusual ticket age.

How to detect it

Alert: MaxTicketAge or MaxRenewAge extended significantly. Alert: any Kerberos policy change outside documented maintenance.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 4713   // Kerberos policy was changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4713
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Kerberos policy was changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Related Policy Change events