Kerberos authentication in Windows domains

Explain how a domain user authenticates to a domain joined PC using Kerberos, including DNS discovery, pre-auth, TGT, session key, and service ticket exchange with the KDC.

Demonstrates using Microsoft Network Monitor to capture and filter Kerberos V5 authentication traffic between a client and a domain controller, guiding step-by-step capture and packet analysis.

Follow the step-by-step Kerberos logon in Windows domains, from entering credentials and pre-authentication to obtaining a TGT and a service ticket, ending with the session key usage.

Smart card logon in Windows domains uses asymmetric cryptography with a private key on the card and a public key in the KDC to exchange a session key and TGT.

Discover how a Windows domain user accesses a Kerberos-enabled website through DNS A record, SPN, and a service account, exchanging TGTs and service tickets for mutual authentication.

Explore how inter-realm Kerberos authentication establishes trust between realms, exchanging inter-realm keys derived from domain trust passwords, and issuing TGTs and service tickets via referrals.

Configure Kerberos in Windows domains, covering prerequisites, KDC discovery via DNS, UDP/TCP port 88, time synchronization via Windows Time service, domain hierarchy, and SPN management with setspn.

Configure Kerberos for IIS with dedicated service accounts, SPNs, and DNS A records for web farm; enable Windows authentication with Kerberos and kernel mode, and configure authPersistNonNTLM and authPersistSingleRequest.

Configure Kerberos for Exchange clients by associating an SPN with the Client Access Service, enabling Kerberos in virtual directories, and deploying an ASA computer account for CAS servers.

Configure Kerberos authentication for Exchange clients with an alternate service account, including AD computer account creation, DNS A record, Autodiscover and internal URL renaming, and SPN setup verification.

Configure Kerberos for SharePoint, SQL, and file servers with dedicated service accounts, SPN registration, and DNS A records; disable IIS kernel mode authentication and enable claims to Windows token service.

Register a CIFS SPN with the file service to enable Kerberos authentication, observe mutual authentication via SMB packets, service tickets, and a forwarded TGT for unconstrained delegation.

Configure Kerberos for non-windows systems by integrating with Active Directory, using a keytab to publish the SPN and realm via KTPass, enabling AES and silent user authentication.

Demonstrate configuring Kerberos for non-windows systems by creating a KeyTab for a Linux service account and mapping the SPN http/MyLinuxApp.test.me with AES256.

Explore ASP.NET impersonation and Kerberos delegation in IIS, enabling per-user local access and delegated remote access, with Windows authentication configuration, app pool credentials, and kernel mode for performance.

Kerberos delegation lets a session access remote resources across multi-tier apps, with unconstrained, constrained, and resource-based constrained delegation, including impersonation and security risks of compromised service accounts.

Demonstrate how a user's TGT with the forwarded flag appears in the service ticket cache when accessing a CIFS service registered for unconstrained delegation, using App1 and GetKerbTix.

Configure constrained delegation in Kerberos by restricting the right to specific services, using protocol transition and the forwardable flag to control access via service for user to self and proxy.

Demonstrate constrained delegation and a double-hop flow across a web server and SQL server, recording events in security logs and traces while configuring DNS, SPN, and service accounts.

Demo of constrained delegation in Windows domains, tracing Kerberos tickets, forwardable flags, and transited services across App1 and DB1 via network packet analysis and security logs.

Resource-based constrained delegation lets back-end service administrators specify which service identities can impersonate users, enabling secure cross-domain authentication via PowerShell with protocol transition always enabled.

demonstrate resource based constrained delegation by marking the mid-tier account as not trusted, then listing MyApp1Svc to delegate to DB1Svc; access succeeds with cached service tickets.

Run services under managed service accounts with 120 character passwords reset every 30 days and configure Kerberos delegation via msDS-AllowedToDelegateTo, userAccountControl, and PrinciplesAllowedToDelegateToAccount for resource-based delegation.

Demonstrates constrained delegation with managed service accounts by creating MyApp1MSA and DB1MSA, registering SPNs, and configuring App1 to run as MyApp1MSA and DB1 as DB1MSA for tested ticket caching.

Demonstrate configuring resource based constrained delegation for managed service accounts by removing DB1 SPNs from MyApp1MSA's AllowedToDelegateTo attribute, adding MyApp1MSA account to DB1MSA's PrinciplesAllowedToDelegateTo attribute, and verifying that delegation works.

Explore how IIS integrates with Kerberos authentication and delegation across mid tier services. Configure endpoint identity with SPNs in WCF, Web API, and .NET Core.

Master Kerberos troubleshooting in Windows domains with a step-by-step checklist: verify domain memberships, SPNs with setspn, time synchronization with W32TM, NTLM checks, and end-to-end Kerberos across tiers.

Troubleshoot IIS in Windows domains by diagnosing oversized PACs from 120+ universal groups, increasing MaxTokenSize to 65535, and aligning SPN, web.config, and ApplicationHost.config with Kerberos delegation.

Analyze WCF and .NET Core issues, including explicit target service identity, net.tcp binding with transport security, impersonation limitations in ASP.NET Core, and protocol transition as a workaround.

Identify and resolve Kerberos authentication issues for local calls between IIS-hosted services, addressing LoopBackCheck and NTLM reflection protections; relocate services to use Kerberos, or add FQDN exceptions via BackConnectionHostnames.

Troubleshoot Kerberos eTypes using advanced logging and network tracing; resolve DES and RC4 issues by resetting the client's password twice with full AD replication to propagate keys.

Investigate how Kerberos delegation misconfigurations cause anonymous logon and bad option errors in Windows domains. Identify KDC options, forwardable and forwarded flags, and ticket details for mid-tier and client authentication.

Re-enable cross-forest TGT delegation by setting EnableTGTDelegation to yes and using NETDOM, while enabling Kerberos advanced logging to audit SPN issues across Windows domain trusts.

Explore troubleshooting tools for Kerberos in Windows domains, including port query, UDL, KList, Kerberos Configuration Manager (SQL Server and IIS), and setspn for SPNs and delegation.

Explore the incompatibility between kernel mode authentication and the negotiate Kerberos provider. Trigger warnings and error modified events when tickets are decrypted by the wrong account, affecting app access.

Explore marking a client as sensitive and cannot be delegated or adding it to Protected Users Group yields non-forwardable TGTs and service tickets, blocking forwardable authentication in Kerberos.

Remove the SQL SPN from the mid-tier service account's 'allowed to delegate to' attribute to simulate delegation, triggering a KDC_ERR_BADOPTION error and an anonymous back-end logon with NTLM challenge/response.

Explore troubleshooting Kerberos eType not supported errors by simulating DES against AES256, inspecting the eType in ticket requests, and resetting user and KRBTGT passwords twice with AD replication.

Enable Kerberos advanced logging across the forest to identify services missing or misconfigured SPNs, and use client and server logs with System Centre Operations Manager to flag principal unknown errors.

Explore Kerberoasting in windows domains, including SPN requirements, offline brute force of service tickets, and defenses using AES256, MSAs, privileged account controls, and PowerShell script block logging.

Learn how AS-REP roasting steals passwords by exploiting accounts with preauthentication disabled. Capture of the AS response with the TGT and offline brute force, plus Kerberos armoring and auditing recommendations.

Explain overpass the hash and pass the ticket attacks, including how attackers obtain tickets to move laterally. Present detection and prevention techniques such as Credential Guard, NLA, and LAPS.

Explore golden and silver ticket forgery, compromising the KRBTGT account to forge TGTs and service tickets, bypass PAC validation, and forge PAC content to access resources across domains.

Assess how an attacker uses the DCSync attack to replicate password hashes from Active Directory by exploiting replication permissions, including replicating directory changes, filtered sets, and full synchronization.

Control delegation permissions and disable weak encryption types on domain controllers. Restrict and monitor the Administrators group, plan to disable RC4, and review Kerberos testing tools to prevent misuse.

Minimize privileged accounts and deploy credential protection, two-factor authentication, smart cards, Credential Guard, and Remote Guard; disable insecure delegation and NTLM; use LAPS and read-only domain controllers to harden Kerberos.

Identify Kerberos principals still using RC4 and enable AES128 and AES256 for all principals. Verify non-AES tickets by checking DC security logs (4768, 4769) and the Kerberos cache with PowerShell.

Audit and enable AES256 encryption across a domain by configuring domain trusts with KSetup, then enable AES for computers and users via group policy or PowerShell, and verify Kerberos tickets.

Identify accounts needing aes256 support, upgrade legacy systems, reset passwords twice with full AD replication, update krbtgt and keytab to aes256, then disable non aes256 eTypes after verification.

Explore Kerberos armoring, the Microsoft FAST implementation that encrypts Kerberos messages to protect against offline and active attacks, and learn how to enable it across clients, KDCs, and domain controllers.

Demonstrates Kerberos armoring misconfiguration by enabling client support for all domain computers except domain controllers and enforcing it for KDCs, with restoration steps via group policy and registry.

This demo shows misconfiguring Kerberos Armoring by enabling client support for domain controllers but not for KDCs, breaking logon and Kerberized apps until you revert the change or disable RequireFAST.

Audit, monitor, and alert Kerberos activities across Active Directory with advanced audit policies, Kerberos logging, and real-time detection of credential failures, ticket requests, and privilege changes.

Develop practical skills for Kerberos troubleshooting in Windows domains by analyzing logs and network traces, correlating security events with packet data to isolate domain account or KDC issues.