Lesson 2.21: Kerberos pre-authentication and AS-REP roasting
Normally a domain controller only issues a TGT after the client proves it knows the password (pre-authentication). Some accounts have that check switched off, usually for an old application, and then anyone can ask for a TGT on their behalf and receive data encrypted with the account's password to crack offline: AS-REP roasting. In the lab you find the account with pre-authentication disabled, see in the DC log that someone already requested its ticket last night, check that nobody legitimately uses it, and disable it with pre-authentication required.
15 min
You will learn to
- Explain Kerberos pre-authentication
- Explain AS-REP roasting
- Find accounts with DONT_REQ_PREAUTH
- Detect 4768 events without pre-authentication
- Remove the flag safely
Key terms
- Kerberos pre-authentication
- The client encrypts a timestamp with its password-derived key so the DC knows it has the password before issuing a TGT.
- DONT_REQ_PREAUTH (4194304)
- userAccountControl flag that switches pre-authentication off for an account.
- AS-REP roasting
- Requesting a TGT for an account without pre-authentication and cracking the encrypted part of the reply offline.
- PreAuthType
- Field in event 4768: 2 = encrypted timestamp (normal), 0 = none.
← Security headers · All lessons · Linux authentication and audit logs →