Hi, I would like to audit the kdc ticket activity:
I mean: I access IIS via kerberos, so I find in event viewer the 672 entry,
then I have a 673 entry corresponding to the name of the server on which IIS
reside, but I do not fine the HHTP\REALMDOMAINNAME kicket entry: where can I
find this? is it the 673 log or not?

thanks a lot.

Mary