Skip to content
IT Atlas

Identity · Authentication

Kerberos

A ticket based authentication protocol that proves identity to services without sending the password across the network.

AdvancedUpdated 2026-09-01

Overview

Kerberos uses a trusted third party, the Key Distribution Center, hosted on domain controllers in Active Directory, to issue time limited tickets. A client proves knowledge of its key once to obtain a Ticket Granting Ticket, then exchanges that for service tickets.

Because tickets are cryptographic artefacts held in memory, most Kerberos attacks are about obtaining or forging tickets rather than cracking the protocol. Understanding ticket types is essential to understanding Windows attack paths.

How it works

  1. 01Service Principal Names map a service instance to an account, allowing the KDC to encrypt the service ticket with that account's key.
  2. 02Delegation lets a service act on a user's behalf: unconstrained (dangerous), constrained, and resource based constrained delegation.
  3. 03Pre authentication protects against offline attacks on the initial request; accounts with it disabled are vulnerable to AS REP roasting.

Sequence

Kerberos exchange
  1. 1AS REQ with pre authentication
  2. 2AS REP returns TGT encrypted with krbtgt key
  3. 3TGS REQ presents TGT and names the service SPN
  4. 4TGS REP returns a service ticket
  5. 5AP REQ presents the service ticket to the target
  6. 6Service validates and creates the session

Clocks must agree within the permitted skew, five minutes by default, or authentication fails.

Security considerations

  • Rotate the krbtgt account password twice, with replication between, after any suspected domain compromise, golden tickets survive everything else.
  • Eliminate unconstrained delegation and audit constrained delegation configurations.
  • Use group managed service accounts so service passwords are long, random and rotated automatically, removing Kerberoasting value.
  • Enforce AES encryption types and disable RC4 where compatibility permits.

Common misconfigurations

  • Human user accounts with SPNs registered and weak passwords.
  • Time synchronisation drift causing intermittent authentication failures.
  • Duplicate SPNs, which break ticket issuance for the affected service.

Primary sources