Event ID 4820: A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.
Event 4820
Security-Auditing
Security log
Audit
Message and fields (as Event Viewer shows them)
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.
Account Information:
Account Name: …
Supplied Realm Name: …
User ID: …
Authentication Policy Information:
Silo Name: …
Policy Name: …
TGT Lifetime: …
Device Information:
Device Name: …
Service Information:
Service Name: …
Service ID: …
Network Information:
Client Address: …
Client Port: …
Additional Information:
Ticket Options: …
Result Code: …
Ticket Encryption Type: …
Pre-Authentication Type: …
Certificate Information:
Certificate Issuer Name: …
Certificate Serial Number: …
Certificate Thumbprint: …
Certificate information is only provided if a certificate was used for pre-authentication.
Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.