Lesson 1.21: Kerberos, NTLM and what they log
Domain logons use Kerberos: you prove your password once to get a ticket-granting ticket, then ask the domain controller for a service ticket for each server. Older NTLM still lingers for devices and applications that can't do Kerberos. Each step writes a security event on the domain controller (4768, 4769, 4771, 4776), and those events are how most AD attacks are detected. In the lab you follow one user's morning through the DC's log, find who still uses NTLM, spot a ticket requested with weak RC4 encryption, and read a failed pre-authentication.
17 min
You will learn to
- Explain the Kerberos TGT and service-ticket flow
- Map Kerberos and NTLM to event IDs
- Follow a user's logons in DC events
- Find remaining NTLM use
- Recognise weak RC4 tickets and failed pre-authentication
Key terms
- Kerberos
- Ticket-based authentication: a TGT proves who you are, service tickets give access to individual services.
- TGT / service ticket
- Ticket-granting ticket from logon / ticket for one service (SPN), encrypted with that service account's key.
- Pre-authentication
- Proving knowledge of the password before the DC issues a TGT.
- NTLM
- The older challenge-response protocol, still used when Kerberos isn't possible (IP addresses, legacy devices).
- Encryption types
- 0x11/0x12 AES-128/256 (strong), 0x17 RC4-HMAC (weak, derived from the NT hash).
← Requests, parameters, cookies and sessions · All lessons · Time, time zones and timelines →