After installing update KB4054519 on Windows 2012R2 DC, Kerberos events are no longer captured. The following warning may be found in the CaadHook.dll.log during agent start-up:
"Cannot find I_Get_ASTicket. Kerberos events will not be available."
You need to be signed in and under a current maintenance contract to view premium knowledge articles.