Kerberos & Authentication
Defending against Kerberoasting and AS-REP roasting
Shrink Kerberoasting and AS-REP roasting exposure: inventory SPNs, remove stale ones, move to gMSA and AES, deploy a honey SPN and detect RC4 4769 spikes.
Foundation
Guides tagged
#kerberoasting
Auditing, Logging & Detection
AD honeytokens: honey accounts, honey SPNs and decoys
Deploy honey accounts, honey SPNs, AS-REP decoys, fake GPP passwords and read-audited decoy objects in AD, and alert on them with near-zero false positives.
Intermediate
Passwords & Service Accounts
Migrating service accounts to gMSA and dMSA
Step-by-step migration from static service accounts to gMSA and Windows Server 2025 dMSA: KDS root key, retrieval rights, per-app notes and rollback.
Intermediate