Kerberos authentication explained for Active Directory defenders

The cast

Kerberos involves three parties: the client, the Key Distribution Center (KDC) running on every domain controller, and the service the client wants to reach. The KDC has two roles. The Authentication Service issues a ticket-granting ticket (TGT) when a user proves who they are. The Ticket-Granting Service exchanges a TGT for a service ticket to a specific service.

Every account has keys derived from its password. The krbtgt account’s key encrypts and signs every TGT in the domain, which is why it is the most sensitive secret in Active Directory.

The exchanges

AS-REQ and AS-REP: the client asks for a TGT and, with pre-authentication, includes a timestamp encrypted with the user’s key. The KDC checks it and returns a TGT encrypted with the krbtgt key, plus a session key. DCs log this as Event 4768. TGS-REQ and TGS-REP: the client presents the TGT and asks for a ticket to a service principal name such as cifs/fileserver. The KDC returns a service ticket encrypted with the service account’s key, logged as Event 4769. AP-REQ: the client presents the service ticket to the service, which decrypts it with its own key.

Kerberos uses TCP and UDP port 88, and clocks must agree within five minutes by default, which is why time sync problems break logons.

• 4768: TGT requested (AS exchange)
• 4769: service ticket requested (TGS exchange)
• 4770: service ticket renewed
• 4771: pre-authentication failed
• 4624 on the target: the resulting logon

Lab: watch one logon in events

Log on to the lab workstation as a domain user and open a share on the member server. On the DC, query 4768 and 4769 for that user in the last few minutes. Read the Service Name field in 4769, which shows which services the user requested tickets for, and the Ticket Encryption Type, where 0x12 means AES256 and 0x17 means RC4.

On the workstation, klist shows the cached TGT and service tickets with their lifetimes, ten hours by default for a TGT.

klist
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4768,4769; StartTime=(Get-Date).AddMinutes(-10)} |
  % { $x=[xml]$_.ToXml(); $d=@{}; $x.Event.EventData.Data | % { $d[$_.Name]=$_.'#text' }
      [pscustomobject]@{Time=$_.TimeCreated; Id=$_.Id; User=$d.TargetUserName; Service=$d.ServiceName; Enc=$d.TicketEncryptionType; From=$d.IpAddress} } | Format-Table

Why defenders care

Most Active Directory attack techniques abuse a step in this flow: requesting service tickets to crack offline, forging tickets with a stolen key, or abusing delegation to request tickets on someone else’s behalf. Each leaves traces in 4768 and 4769, so understanding the normal flow makes the abnormal stand out.

Moving all accounts to AES encryption and retiring RC4 removes a large class of offline cracking risk.