Glossary
AS-REP ROASTING
defined.
An Active Directory attack against accounts with Kerberos preauthentication disabled — letting an attacker harvest crackable AS-REP responses for any such account.
A–Z
An Active Directory attack against accounts with Kerberos preauthentication disabled — letting an attacker harvest crackable AS-REP responses for any such account.
Accounts with the DONT_REQ_PREAUTH UAC flag (often legacy service accounts) return a TGT that’s encrypted with the user’s password hash — no authentication required to request it. Tools like Rubeus automate harvesting.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.