Extend Kerberos security events with cipher suite, ticket options and other fields to make data human readable that is stored as hex values

Get-KerberosEncTypes.ps1

$types = @'
using System;

namespace Kerberos
{
    public enum EncryptionTypes:uint
    {
        AES256_CTS_HMAC_SHA1_96 = 18,
        AES128_CTS_HMAC_SHA1_96 = 17,
        ARCFOUR_HMAC_MD5 = 23,
        DES_CBC_MD5 = 3,
        DES_CBC_CRC = 1,
        ARCFOUR_HMAC_MD5_56 = 24,
        unknown=4294967295
    }

    public enum Errors
    {
        KDC_ERR_NONE = 0x0,
        KDC_ERR_NAME_EXP = 0x1,
        KDC_ERR_SERVICE_EXP = 0x2,
        KDC_ERR_BAD_PVNO = 0x3,
        KDC_ERR_C_OLD_MAST_KVNO = 0x4,
        KDC_ERR_S_OLD_MAST_KVNO = 0x5,
        KDC_ERR_C_PRINCIPAL_UNKNOWN = 0x6,
        KDC_ERR_S_PRINCIPAL_UNKNOWN = 0x7,
        KDC_ERR_PRINCIPAL_NOT_UNIQUE = 0x8,
        KDC_ERR_NULL_KEY = 0x9,
        KDC_ERR_CANNOT_POSTDATE = 0xA,
        KDC_ERR_NEVER_VALID = 0xB,
        KDC_ERR_POLICY = 0xC,
        KDC_ERR_BADOPTION = 0xD,
        KDC_ERR_ETYPE_NOTSUPP = 0xE,
        KDC_ERR_SUMTYPE_NOSUPP = 0xF,
        KDC_ERR_PADATA_TYPE_NOSUPP = 0x10,
        KDC_ERR_TRTYPE_NO_SUPP = 0x11,
        KDC_ERR_CLIENT_REVOKED = 0x12,
        KDC_ERR_SERVICE_REVOKED = 0x13,
        KDC_ERR_TGT_REVOKED = 0x14,
        KDC_ERR_CLIENT_NOTYET = 0x15,
        KDC_ERR_SERVICE_NOTYET = 0x16,
        KDC_ERR_KEY_EXPIRED = 0x17,
        KDC_ERR_PREAUTH_FAILED = 0x18,
        KDC_ERR_PREAUTH_REQUIRED = 0x19,
        KDC_ERR_SERVER_NOMATCH = 0x1A,
        KDC_ERR_SVC_UNAVAILABLE = 0x1B,
        KRB_AP_ERR_BAD_INTEGRITY = 0x1F,
        KRB_AP_ERR_TKT_EXPIRED = 0x20,
        KRB_AP_ERR_TKT_NYV = 0x21,
        KRB_AP_ERR_REPEAT = 0x22,
        KRB_AP_ERR_NOT_US = 0x23,
        KRB_AP_ERR_BADMATCH = 0x24,
        KRB_AP_ERR_SKEW = 0x25,
        KRB_AP_ERR_BADADDR = 0x26,
        KRB_AP_ERR_BADVERSION = 0x27,
        KRB_AP_ERR_MSG_TYPE = 0x28,
        KRB_AP_ERR_MODIFIED = 0x29,
        KRB_AP_ERR_BADORDER = 0x2A,
        KRB_AP_ERR_BADKEYVER = 0x2C,
        KRB_AP_ERR_NOKEY = 0x2D,
        KRB_AP_ERR_MUT_FAIL = 0x2E,
        KRB_AP_ERR_BADDIRECTION = 0x2F,
        KRB_AP_ERR_METHOD = 0x30,
        KRB_AP_ERR_BADSEQ = 0x31,
        KRB_AP_ERR_INAPP_CKSUM = 0x32,
        KRB_AP_PATH_NOT_ACCEPTED = 0x33,
        KRB_ERR_RESPONSE_TOO_BIG = 0x34,
        KRB_ERR_GENERIC = 0x3C,
        KRB_ERR_FIELD_TOOLONG = 0x3D,
        KDC_ERR_CLIENT_NOT_TRUSTED = 0x3E,
        KDC_ERR_KDC_NOT_TRUSTED = 0x3F,
        KDC_ERR_INVALID_SIG = 0x40,
        KDC_ERR_KEY_TOO_WEAK = 0x41,
        KRB_AP_ERR_USER_TO_USER_REQUIRED = 0x42,
        KRB_AP_ERR_NO_TGT = 0x43,
        KDC_ERR_WRONG_REALM = 0x44
    }

    [Flags()]
    public enum TicketOptions
    {
        validate = 0x00000001,
        renew = 0x00000002,
        enc_tkt_in_skey = 0x00000008,
        renewable_ok = 0x00000010,
        name_canonicalize = 0x00010000,
        cname_in_addl_tkt = 0x00020000,
        forwardable = 0x40000000,
        forwarded = 0x20000000,
        hw_authent = 0x00100000,
        initial = 0x00400000,
        invalid = 0x01000000,
        may_postdate = 0x04000000,
        ok_as_delegate = 0x00040000,
        postdated = 0x02000000,
       pre_authent = 0x00200000,
        proxiable = 0x10000000,
        proxy = 0x08000000,
        renewable = 0x00800000,
    }
}
'@

Add-Type -TypeDefinition $types

function Expand-Event
{
    param(
        [Parameter(Mandatory, ValueFromPipeline)]
        [System.Diagnostics.EventLogEntry]$Event
    )

    begin { }

    process
    {
        switch ($Event.EventID)
        {
            4768
            {
                $Event | Add-Member -Name UserName -MemberType NoteProperty -Value $Event.ReplacementStrings[0] -Force
                $Event | Add-Member -Name Domain -MemberType NoteProperty -Value $Event.ReplacementStrings[1]
                $Event | Add-Member -Name ClientIpAddress -MemberType NoteProperty -Value $Event.ReplacementStrings[9]
                $Event | Add-Member -Name ServiceName -MemberType NoteProperty -Value $Event.ReplacementStrings[3]
                $Event | Add-Member -Name TicketOptions -MemberType NoteProperty -Value ([Kerberos.TicketOptions][Convert]::ToString($Event.ReplacementStrings[5], 10))
                $Event | Add-Member -Name ResultCode -MemberType NoteProperty -Value ([Kerberos.Errors][Convert]::ToString($Event.ReplacementStrings[6], 10))
                $Event | Add-Member -Name TicketEncType -MemberType NoteProperty -Value ([Kerberos.EncryptionTypes][Convert]::ToString($Event.ReplacementStrings[7], 10))
            }

            4769
            {
                $Event | Add-Member -Name UserName -MemberType NoteProperty -Value $Event.ReplacementStrings[0] -Force
                $Event | Add-Member -Name Domain -MemberType NoteProperty -Value $Event.ReplacementStrings[1]
                $Event | Add-Member -Name LogonGuid -MemberType NoteProperty -Value $Event.ReplacementStrings[9]
                $Event | Add-Member -Name ClientIpAddress -MemberType NoteProperty -Value $Event.ReplacementStrings[6]
                $Event | Add-Member -Name ServiceName -MemberType NoteProperty -Value $Event.ReplacementStrings[2]
                $Event | Add-Member -Name TicketOptions -MemberType NoteProperty -Value ([Kerberos.TicketOptions][Convert]::ToString($Event.ReplacementStrings[4], 10))
                $Event | Add-Member -Name ResultCode -MemberType NoteProperty -Value ([Kerberos.Errors][Convert]::ToString($Event.ReplacementStrings[8], 10))
                $Event | Add-Member -Name TicketEncType -MemberType NoteProperty -Value ([Kerberos.EncryptionTypes][Convert]::ToString($Event.ReplacementStrings[5], 10))
            }
        }

        $Event
    }

    end { }
}

$events = Get-EventLog Security -Newest 100000 -InstanceId 4768, 4769 -After (Get-Date).AddHours(-1) | Expand-Event
$events | Group-Object -Property TicketEncType | Format-Table -Property Count, Name -AutoSize