Two authentication flows
Label: original fictional cards. No ticket was requested and no challenge was sent.

Flow K, three parties from the Windows Kerberos overview.
Client: a security principal, such as user lea.
KDC: Key Distribution Center. On a Windows domain the overview says it runs on a domain controller and uses the Active Directory database.
Service: files-3, the service lea wants.

K1. The client contacts the KDC and receives a ticket-granting ticket, a TGT.
K2. The client presents the TGT to the KDC and asks for a service ticket for files-3.
K3. The client presents that service ticket to files-3.
The overview says the service can then check the ticket without asking a domain controller on every connection.
No ticket bytes are printed. A ticket is still a secret on a real network.

Flow N, challenge-response, from Microsoft's NTLM descriptions.
N1. The client sends a user name.
N2. The server sends a challenge, a random value.
N3. The client returns a response computed from the challenge and the password secret.
N4. The server, or a domain controller that holds the account secret, checks the response.
The password itself is not the response. The response is still authentication material. Keep it private.
Flow N has no KDC and no ticket.

These cards do not say which protocol a real Windows sign-in used. A sign-in has to name its flow.