Kerberos Pre-Auth: Hidden AD Risk

🎙️ In this episode, Craig Birch exposes one of the most overlooked Active Directory misconfigurations: the “Do not require Kerberos pre-authentication” setting.
Attackers love it — it enables AS-REP Roasting, silent user enumeration, and offline password cracking — and it often flies under the radar of SIEMs and detection tools.

• What Kerberos pre-auth actually does
• How disabling it creates an AS-REP Roasting risk
• Why this setting leads to silent user enumeration
• How attackers extract TGTs for cracking with Hashcat/John
• PowerShell steps to detect and remediate it safely

🔍 What You’ll Learn:

• What Kerberos pre-auth actually does
• How disabling it creates an AS-REP Roasting risk
• Why this setting leads to silent user enumeration
• How attackers extract TGTs for cracking with Hashcat/John Ripper
• PowerShell steps to detect and remediate it safely

🛠️ PowerShell Spotlight:# Import the AD module

Import-Module ActiveDirectory

# Find accounts vulnerable to AS-REP Roasting

$users = Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth

# Output affected accounts

$users | Select-Object Name, SamAccountName, UserPrincipalName

# Optional: Remediation (confirmation step)

Read-Host -Prompt "Press Enter to remediate these accounts"

foreach ($user in $users) {

Set-ADAccountControl -Identity $user -DoesNotRequirePreAuth $false

}

✅ Use this to detect and fix accounts vulnerable to offline ticket cracking.✅ Quick Takeaways:

• AS-REP Roasting bypasses standard authentication failure logging

• Pre-auth disabled = easy ticket extraction and brute-force attempts

• This setting is often set by legacy apps or weak GPOs

• Always confirm account function before remediation

• Add detection logic to your SIEM or use scheduled PowerShell audits

💬 Found this helpful? Like, share, or comment. Got a topic for a future 10-minute breakdown? Drop it below — we’re listening.

📌 Powered by Guardians of the Directory