AD-KRB-002: Accounts without Kerberos pre-authentication (AS-REP roasting)¶

high Kerberos MITRE ATT&CK T1558.004 Reads: LDAP

Enabled user accounts that do not require Kerberos pre-authentication, so anyone can get material encrypted with their password and crack it offline.

Also known as: asrep-roasting, asreproast

Why it matters¶

Normally a client proves it knows the user's password before the KDC answers: the AS-REQ carries a timestamp encrypted with the user's key (pre-authentication). With Do not require Kerberos preauthentication set, the KDC skips that step and returns an AS-REP to anyone who asks for the account. Part of that reply is encrypted with a key derived from the user's password.

The attacker does not need a domain account, only network access to a DC and the user name. They take the AS-REP offline and guess the password with no failed logons and no lockout (AS-REP roasting). The flag is usually set for an old Unix or Java Kerberos client that once could not do pre-authentication, and then forgotten.

How ad-doctor detects it¶

From the LDAP snapshot: every enabled user account with the DONT_REQ_PREAUTH bit (0x400000) in userAccountControl. Computer accounts and managed service accounts (gMSA, sMSA, dMSA) are skipped. One finding lists every account by sAMAccountName, for example legacy_app.

ad-doctor does not send any AS-REQ: the result comes from the directory data alone.

Attributes and probes read

userAccountControl
objectClass

Severity¶

Always high: one such account is enough, and no credentials are needed to attack it.

False positives and limits¶

An application that really cannot pre-authenticate. Check with the vendor first: current Kerberos clients support it. If one remains, give the account a long random password and record the decision in an accepted-risk file with an owner and an expiry date.
Honeypot accounts created to catch AS-REP roasting: accept them the same way.

Fix¶

List the accounts (read-only):

Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $true' -Properties PasswordLastSet |
    Select-Object SamAccountName, Enabled, PasswordLastSet

Require pre-authentication again on each account, then test the application that uses it:
```
Set-ADAccountControl legacy_app -DoesNotRequirePreAuth $false -WhatIf
```
Reset the password of every account that had the flag. Its AS-REP may already have been collected and cracked.
Detect attempts: on domain controllers, event 4768 with Pre-Authentication Type 0 shows a TGT issued without pre-authentication.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-KRB-002

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-KRB-002"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References¶

Microsoft and vendors

Research

MITRE ATT&CK

T1558.004

Available since 0.1.0.