Kerberoasting: protecting service accounts before their passwords are cracked offline
Kerberoasting requires no special privilege: any domain account will do. It targets user accounts that carry a service principal name, very often old, privileged service accounts with passwords unchanged for years. The good news is that the countermeasures are well known and effective.
How the attack works
When a user wants to access a service, they ask the domain controller for a service ticket (TGS) for the matching SPN. Part of that ticket is encrypted with a key derived from the password of the account holding the SPN. The attacker requests these tickets, extracts them and tries to recover the password offline, without generating any failed logon. Computer accounts are barely exposed because their passwords are long, random and rotated automatically. User accounts with SPNs, on the other hand, depend entirely on the quality of their password.
RC4 versus AES
The encryption type makes a big difference. A ticket encrypted with RC4 is much faster to attack than an AES ticket. Yet many service accounts still accept RC4, either because msDS-SupportedEncryptionTypes is not set or because their password predates the generation of AES keys in the domain. Microsoft has started phasing RC4 out of Kerberos; follow the announced timeline and test your applications before enforcing AES.
Get-ADUser -Filter 'ServicePrincipalName -like "*"' -Properties ServicePrincipalName, PasswordLastSet, msDS-SupportedEncryptionTypes, adminCount |
Select-Object SamAccountName, PasswordLastSet, msDS-SupportedEncryptionTypes, adminCount, ServicePrincipalName
Measures that work
- Remove unnecessary SPNs. An SPN left on an account after an application was retired is a free target.
- Move to managed service accounts. gMSAs have a long random password rotated automatically, which makes cracking unrealistic. Windows Server 2025 introduces dMSAs (delegated managed service accounts), designed to ease migration from traditional service accounts; they require a Windows Server 2025 environment and deserve careful evaluation.
- Enforce long random passwords for accounts that cannot migrate: 25 characters or more, generated and stored in a vault.
- Enforce AES and reset the password of old accounts so AES keys are generated.
- Remove excessive privileges. A service account in Domain Admins turns one cracked password into full compromise.
Top priority. Start with SPN-bearing accounts that have adminCount=1 or a password older than three years. Those are the ones attackers go after first.
Detecting Kerberoasting
Event 4769 (service ticket request), logged on domain controllers when the relevant auditing is enabled, is the main source. Useful signals include encryption type 0x17 (RC4) in an environment that should use AES, a burst of requests for many different SPNs from a single account, or requests for rarely used services. A decoy account with an SPN that is never used legitimately also makes a very reliable tripwire.
What an audit checks
- user accounts carrying an SPN, their password age and their privileges;
- the encryption types those accounts accept;
- actual use of gMSAs;
- service ticket auditing configuration on domain controllers.