Any user in your domain can ask for a service ticket for any account with a service principal name. Part of that ticket is protected by the service account’s password. If that password is weak, it can be guessed offline, with no failed logons and no lockouts. That’s Kerberoasting. It’s been showing up in real AD attacks for over a decade. Here’s how to find the accounts at risk and take them off the table.

Learn why disabling Kerberos pre-authentication exposes Active Directory accounts to AS-REP roasting, how attackers exploit this weakness, and how to detect and remediate vulnerable accounts.

DES is a decades-old encryption standard still found on some Active Directory accounts. When Kerberos is restricted to DES only, it weakens credential protection and opens the door to offline password cracking, especially on service accounts with excessive privilege.

Some Active Directory accounts are quietly exempt from your domain’s password policy. Here’s what the Password Not Required setting actually does, why it shows up more often than most teams realize, and how to find and remediate it before an attacker does.