AD domain account with Kerberos pre-authentication disabled

An account with Kerberos pre-authentication disabled doesn´t have sufficient protection against password-guessing attacks.

The Key Distribution Center (KDC) is available as part of the domain controller and performs two key functions which are: Authentication Service (AS) and Ticket-Granting Service (TGS). By default the KDC requires all accounts to use pre-authentication. This is a security feature which offers protection against password-guessing attacks.

If pre-authentication is enabled, a time stamp will be encrypted using the user’s password hash as an encryption key. If the KDC reads a valid time when using the user’s password hash, which is available in the Active Directory, to decrypt the time stamp, the KDC knows that request isn’t a replay of a previous request. When you do not enforce pre-authentication, a malicious actor can directly send a dummy request for authentication. The KDC will return an encrypted TGT and the malicious actor can brute force it offline.

Enable pre-authentication on all users. If disabling pre-authentication is required, consider reducing permissions of accounts with disabled pre-authentication. Kerberos pre-authentication can prevent the active attacker. However, it does not prevent a passive attacker from sniffing the client’s encrypted timestamp message to the KDC. If the attacker can sniff that full packet, he can brute force it offline. To mitigate this problem, it is recommended that the users use lengthy passwords. Additionally, a good password rotation policy should also be implemented in the domain to make the offline brute-forcing infeasible or increasingly difficult.

Learn more about Kerberos pre-authentication.