Tools · Active Directory defense · 04 / 23
AS-REP roasting: find accounts with Kerberos pre-authentication disabled
Learn why “Do not require Kerberos preauthentication” exposes an account to offline guessing, find every such account, detect requests, and turn the flag off.
Why the flag matters
Kerberos pre-authentication makes the client prove knowledge of its password before the KDC returns anything encrypted with that password. If an account has the DONT_REQ_PREAUTH flag set, anyone can ask the KDC for an AS-REP for that account and receive data encrypted with the account’s key, which can then be guessed offline. The requester does not even need valid credentials.
The flag exists for compatibility with very old Kerberos clients. Today it is almost always a mistake left over from troubleshooting or a legacy application.
Find affected accounts
The flag is bit 0x400000 in userAccountControl. PowerShell exposes it as DoesNotRequirePreAuth. Any results deserve an owner and a reason.
On the DC, Event 4768 with Pre-Authentication Type 0 shows a TGT issued without pre-authentication. Those events for an account that should not have the flag, or from an unusual source, are the detection.
Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $true' -Properties DoesNotRequirePreAuth, PasswordLastSet, Enabled | Select Name, Enabled, PasswordLastSet
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768; StartTime=(Get-Date).AddDays(-1)} |
Where-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object { $_.Name -eq 'PreAuthType' -and $_.'#text' -eq '0' } } | Select TimeCreated, Message -First 5Lab: set, observe, and fix
In the lab from the earlier tutorial, user7 has the flag set. Run the query above to find it. From the workstation, request a TGT for user7 using a Kerberos client that supports requests without pre-authentication, such as the MIT kinit on a Linux VM joined to the lab realm configuration, and observe 4768 with PreAuthType 0 on the DC.
Then clear the flag with Set-ADAccountControl and repeat. The KDC now replies with a pre-authentication required error instead of encrypted data.
Set-ADAccountControl -Identity user7 -DoesNotRequirePreAuth $false Get-ADUser user7 -Properties DoesNotRequirePreAuth | Select Name, DoesNotRequirePreAuth
Keep it fixed
Add the query to your monthly AD health check and alert on Event 5136 changes to userAccountControl that set the flag. If an application truly needs it, give that account a long random password and monitor its 4768 events closely.
PingCastle and similar health checks flag these accounts automatically.
Diagram
With and without pre-authentication
What an unauthenticated requester receives.
Request. Anyone asks for the account’s AS-REP.
Reply. Data encrypted with the account’s key.
Risk. Offline password guessing.
Request. Must include an encrypted timestamp.
Reply. Error until the client proves the password.
Risk. Online guessing only, which is logged and rate-limited.
Check yourself
1. Who can request an AS-REP for an account with pre-authentication disabled?
2. Which PowerShell filter finds affected accounts?
3. Which 4768 field value shows no pre-authentication was used?