Active Directory Service Principal Name (SPN) Discovery & Kerberoasting Triage

Stage 01 - Concept

Kerberos TGS Requests & The Kerberoasting Threat

Kerberos relies on symmetric cryptography to secure service authentication tickets.

When a user accesses a network service (e.g. SQL Server, IIS), they present their Ticket Granting Ticket (TGT) to the Key Distribution Center (KDC) in a TGS-REQ message. The KDC issues a TGS-REP containing the service ticket encrypted with the service account's secret key (NTLM hash or AES key). Crucially, the KDC does not verify whether the requesting user is authorized to use the service before issuing the ticket. If the service account utilizes a user account with a weak password, attackers crack the hash offline.

Stage 02 - Why It Matters

Why Kerberoasting is a Top Active Directory Vector

Kerberoasting requires zero elevated privileges and generates minimal logging on Domain Controllers.

Stage 03 - Environment Setup

Inspecting Synthetic Directory Telemetry

Load and examine synthetic domain account records for registered SPNs.

Run a PowerShell query filtering for user objects possessing populated `ServicePrincipalName` attributes.

# Enumerate user accounts registered with SPNs in the domain

COMMANDLOCAL

$

Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName,msDS-SupportedEncryptionTypes,PasswordLastSet

Stage 04 - Execution

Evaluating Encryption Types & Account Configurations

Inspect the output attributes to evaluate ticket cipher downgrades.

Check the `msDS-SupportedEncryptionTypes` integer bitmask to determine if the account supports AES-128 (0x8), AES-256 (0x10), or defaults to legacy RC4-HMAC (0x4).

# Query specific SQL Server SPNs across domain forest

COMMANDTASK

$setspn.exe -T corp.local -Q MSSQLSvc/*

Stage 05 - Output & Telemetry

Active Directory Query Output Telemetry

Notice that `svc_sqlprod` is configured with `msDS-SupportedEncryptionTypes: 0x4`. This forces the KDC to emit tickets encrypted with RC4-HMAC, which is orders of magnitude faster to crack in Hashcat than AES-256.

TELEMETRY / COMMAND OUTPUT

DistinguishedName : CN=svc_sqlprod,OU=ServiceAccounts,DC=corp,DC=local
Name              : svc_sqlprod
SamAccountName    : svc_sqlprod
ServicePrincipalNames : {MSSQLSvc/db01.corp.local:1433, MSSQLSvc/db01.corp.local}
msDS-SupportedEncryptionTypes : 0x4 (RC4_HMAC_MD5)
PasswordLastSet   : 2023-04-12 09:14:22
PasswordNeverExpires : True

Stage 06 - Analysis & Interpretation

Deconstructing Encryption Downgrades

Why RC4-HMAC tickets represent immediate risk.

›Hashcat can compute over 10 billion RC4 hashes per second on modern consumer GPUs, compared to under 100 million for AES-256.
›Account passwords older than 365 days with `PasswordNeverExpires: True` frequently use dictionary-guessable corporate patterns.
›Service accounts frequently belong to elevated domain groups (e.g. Domain Admins, SQL Admins), leading to full domain takeover.

Stage 07 - Security Impact

Enterprise Defense: gMSA & Encryption Policies

Vulnerability Exposure & Attack Vectors

✕Offline password cracking leading to domain administrator credential exposure.
✕Lateral movement from compromised workstations to core database servers.

Hardening & Remediation Guidance

✓Migrate all user-backed service accounts to Group Managed Service Accounts (gMSA), which feature automatically rotated 128-character complex passwords managed by Domain Controllers.
✓Disable RC4-HMAC domain-wide via Group Policy: `Network security: Configure encryption types allowed for Kerberos` set to AES128_HMAC_SHA1 and AES256_HMAC_SHA1.
✓Deploy honeytoken service accounts (unattached SPNs) and monitor Windows Event ID 4769 for immediate intrusion detection.

Stage 08 - Validation Checkpoint

Validation Checkpoint

FREE ACCOUNT REQUIRED

100% Free Access

READY TO PRACTICE?

Create a free account to start this lab, record your attempt, and track your progress.

Continue with Google

No credit card required. Public educational platform.

Stage 09 - Next Steps & Hardening

Next Steps & Defense In Depth

Solidify your Active Directory identity defenses.

Recommended Actions:

→Audit your organization's SPNs with `Get-ADUser -Filter {ServicePrincipalName -like '*'}`.
→Review Event 4769 ticket encryption types (Ticket Encryption Type: 0x17 = RC4, 0x12 = AES256).
→Read the Active Directory Kerberos Security Field Guide.