Kerberoasting is an attack on service accounts, and it works because Kerberos is doing exactly what it was designed to do. Any signed-in domain user can ask a domain controller for a service ticket to any account that has a service principal name (SPN). Part of that ticket is encrypted with a key made from the service account's password, so the attacker takes the ticket away and guesses the password offline. There are no failed logons and no lockouts to notice.
So the weak point is not Kerberos. It is a human-chosen password on an account with an SPN, made worse when the ticket uses RC4 instead of AES. Computer accounts and group managed service accounts (gMSAs) are safe from this because their passwords are long, random and rotated automatically.
The first job is to know which ordinary user accounts carry an SPN:
Get-ADUser -Filter {ServicePrincipalName -like "*"} `
-Properties ServicePrincipalName, PasswordLastSet, msDS-SupportedEncryptionTypes, adminCount |
Select-Object Name, PasswordLastSet, msDS-SupportedEncryptionTypes, adminCount, ServicePrincipalName
An old password, an adminCount of 1 or no AES setting each push an account to the top of your list. The full guide shows how to move accounts to gMSAs, force AES, and spot an attack by watching event 4769 for RC4 tickets.
Read the full guide: https://learnitlessons.com/articles/kerberoasting-explained-prevention/
A read-only version of this audit is in my GitHub lab scripts: https://github.com/vitalii-shumylo/it-lab-scripts
Written with AI assistance and checked by the author.
Top comments (0)