RODC Golden Ticket is a forged Kerberos ticket created using secrets from a read-only domain controller account or its replicated credential material. It lets an attacker impersonate identities in ways that bypass normal authentication controls. Defenders should protect RODC accounts, limit replication exposure, and watch for abnormal ticket-granting activity.
How RODC Golden Tickets Work
RODC golden ticket attack abuse Kerberos trust by turning material from a read-only domain controller account into a forged ticket that looks legitimate to downstream services. The core danger is not the ticket format itself, but the fact that the attacker can present cryptographically plausible credentials that inherit authority the environment is willing to accept.
This matters because Kerberos is designed to reduce repeated password checking and rely on issued tickets. When an attacker can mint or replay a forged ticket derived from controller-related secrets, normal authentication pathways are bypassed and access decisions become difficult to distinguish from legitimate activity.
Why the RODC Trust Boundary Matters
A read-only domain controller is supposed to be a constrained replication and authentication component, not a source of broad privilege. The attack becomes possible when replicated credential material or account secrets associated with that controller can be abused to impersonate identities beyond the level defenders expect.
The practical lesson is that trust around an RODC is not just about availability or segmentation. It is about whether the secrets it stores, replicates, or exposes can be converted into reusable impersonation material that survives ordinary password-based defenses.
Exposure, Detection, and Verification
Organisations should verify which RODC accounts exist, where they are deployed, and which credential material is allowed to replicate to them. The most useful exposure checks are inventory-led: know the controller boundary, confirm which systems can reach it, and review whether replication scope matches the intended administrative model.
Detection should focus on anomalies that suggest forged-ticket use rather than ordinary logon noise. Unusual ticket-granting activity, unexpected Kerberos service ticket patterns, and access that does not fit the normal profile of the account or host are the kinds of signals that can reveal abuse after the fact.
For broader Kerberos hardening guidance, the Kerberos Security Guide is the best place to align ticket abuse patterns with defensive controls and detection strategy.
Remediation and Identity Impact
When exploitation is suspected, the response is not limited to blocking a single host. Defenders may need to treat related Kerberos material as compromised, review controller secrets and replication paths, and assess whether any session, service, or administrative access established through the forged ticket should be considered untrusted.
If the attack succeeded, the identity impact can be broad because a forged Kerberos ticket may grant access as another principal without needing that principal’s password in real time. That makes post-incident review of credentials, tickets, and any service-account dependencies especially important.
Identity-focused monitoring and response playbooks are covered in the Identity Threat Detection and Response (ITDR) Guide, which is useful when the compromise path is identity abuse rather than classic malware execution.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1558 — Steal or Forge Kerberos Tickets | RODC Golden Ticket is a forged Kerberos ticket attack path. |
| Recommendation — Map forged-ticket activity to T1558 and hunt for abnormal Kerberos ticket use and delegation abuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The term centers on stolen or forged Kerberos material and its lifecycle. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing unusual ticket-granting and authentication events. | |
| AC-6 — Least Privilege | RODC compromise is damaging because excess privilege expands impersonation reach. | |
| Recommendation — Rotate and protect Kerberos-related authenticators and derived secrets when ticket compromise is suspected. Correlate Kerberos events and review anomalous ticket-granting patterns for signs of forged access. Limit RODC and replicated account privileges so compromised ticket material yields less access. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | The attack exploits implicit trust in presented tickets and controller-derived authority. |
| Recommendation — Reduce implicit trust in Kerberos-presented identity by continuously verifying access context. | ||
Related resources from NHI Mgmt Group
- How should security teams reduce the risk of Golden Ticket attacks in Active Directory?
- Why are Golden Ticket attacks so difficult to contain once KRBTGT is compromised?
- What is the difference between a normal Kerberos ticket issue and a Golden Ticket attack?
- What breaks when Golden Ticket abuse is not detected quickly?