PW-007Attack pathKerberos, passwords and credentials

Kerberos pre-authentication disabled (AS-REP roasting)

An account has Kerberos pre-authentication turned off, so anyone on the network can obtain data to crack its password offline.

Category: Attack Path if it reaches Tier Zero, else Hygiene.
Severity: From exposure, or Medium.
Typical owner: AD / identity team
Data needed: Any collection: the setting is a flag in each account's userAccountControl.

MITRE ATT&CKT1558.004

Most useful toDefensive engineers Identity and access engineers Offensive operators

On this page

In plain language

Normally, Kerberos makes you prove you know your password (pre-authentication) before it sends you anything encrypted with it. For accounts with "Do not require Kerberos preauthentication" ticked, that check is skipped: anyone who can reach a domain controller can request a response for the account and try to crack its password offline. They don't even need an account of their own.

The setting is almost always a leftover from old software. Pathwarden rates it higher when the account is privileged or has a path to Tier Zero.

What Pathwarden flags

The account has "Do not require Kerberos preauthentication" set. Anyone who can reach a domain controller can request an authentication response for it without knowing its password, and part of that response is encrypted with the password.

How attackers use it

AS-REP roasting (Steal or Forge Kerberos Tickets: AS-REP Roasting, T1558.004) does not even need a domain account: an attacker on the network asks for the response and cracks it offline. If the password is weak, they get the account; if the account is privileged or has a path to Tier Zero, that is domain compromise.

Find it with Pathwarden

Data needed: Any collection: the setting is a flag in each account's userAccountControl.

In the web UI or the HTML report, open the Findings tab and expand PW-007: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell

# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-007
# the step-by-step guide on this page, offline
pathwarden guide PW-007
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-007

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

The flag is almost always a leftover from old Unix/Kerberos interop or a vendor install guide. Ask the account owner which system uses it.
Check recent use: event 4768 on domain controllers with "Pre-Authentication Type" 0 for this account shows clients authenticating without pre-auth.
Very old MIT Kerberos or Java clients may fail once pre-auth is required; test with the owning application.

How to fix it

Option A: Require pre-authentication (recommended)

Active Directory Users and Computers > the account > Properties > Account.
Under Account options, clear Do not require Kerberos preauthentication.
OK, then test the application that uses the account.

Option B: If an application genuinely needs it

Keep the flag only with a long random password (25+ characters), no privileged group memberships, and monitoring of event 4768 for that account.

PowerShell

Import-Module ActiveDirectory

# All accounts with pre-authentication disabled
Get-ADUser -Filter { DoesNotRequirePreAuth -eq $true } -Properties DoesNotRequirePreAuth, Enabled

# Require pre-authentication again
Set-ADAccountControl -Identity "<Account>" -DoesNotRequirePreAuth $false

# Option B: set a long random password if the flag must stay
Set-ADAccountPassword -Identity "<Account>" -Reset -NewPassword (Read-Host -AsSecureString "New password")

Verify the fix

Get-ADUser "<Account>" -Properties DoesNotRequirePreAuth must show False. Collect again (or use Retest on the finding) and confirm the finding ID is gone.

Roll back

Set-ADAccountControl -Identity "<Account>" -DoesNotRequirePreAuth $true restores the previous behavior if an application breaks; then plan Option B for that account.

References

Microsoft: Set-ADAccountControllearn.microsoft.com
MITRE ATT&CK T1558.004: Steal or Forge Kerberos Tickets: AS-REP Roastingattack.mitre.org