Labs / Active Directory, defender view
Tickets issued without pre-authentication
Find TGT requests with Pre-Authentication Type 0 in the DC log, confirm the accounts have “Do not require Kerberos preauthentication” set, and spot the one changed minutes earlier.
Briefing
Normally a client proves it knows the password before the DC hands out a TGT (pre-authentication type 2, or 15 for smart cards). Accounts with DONT_REQ_PREAUTH get a TGT for anyone who asks, and part of the reply is encrypted with the user’s key, so it can be cracked offline. This is AS-REP roasting.
You have DC-02’s Security log and an LDIF export of the user objects. DONT_REQ_PREAUTH is the 4194304 bit in userAccountControl.
DC-02 · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.