Remove event ID 672

Event 672 is related to the granting of Kerberos tickets. It is extraneous due to other authentication events for the same action being logged. From Microsoft:

Does not contain any additional information if audit details from logon events 528 and 540 are already being collected. This event records that a Kerberos TGT was granted, actual access will not occur until a service ticket is granted, which is audited by Event 673.