Kerberos service ticket denied due to access control restrictions.
Similar to 4820 but for TGS. Indicates failed access to a service with conditional access policies.
Alert: repeated denials for sensitive services.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4821 // A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4821
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions. Kerberos service ticket denied due to access control restrictions.
Event 4821 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Alert: repeated denials for sensitive services.