Auditing of Account Logon: Kerberos Service Ticket Operations events on failure should be enabled or disabled as appropriate. This security policy setting determines whether the operating system generates security audit events for Kerberos service ticket requests. Events are generated every time Kerberos is used to authenticate a user to access a protected network resource. Kerberos service ticket operation audit events can be used to track user activity. Fix: (1) GPO: Commandline: auditpol.exe (2) REG: NO INFO