Forum Discussion

NinjaKitty's avatar
NinjaKitty
Copper Contributor
Nov 21, 2023

Suspected Golden Ticket usage (time anomaly) false positive

We are currently evaluating Windows Hello. Since then we have regularly received the following defender identity warning for our testgroup only: Suspected Golden Ticket usage (time anomaly).   The ...
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Nov 22, 2023
That means the sensor was not able to read the kerberos policy data for this domain.
Could be some hardening used which blocks the AD account provided from reading the data.

Resources