Topic starter
02/02/2026 8:33 pm
TL;DR: Kerberoasting lets a valid domain account request Kerberos service tickets for SPN-enabled service accounts, then crack the encrypted tickets offline to recover plaintext passwords and escalate privileges, according to Semperis. The attack remains relevant because weak service-account hygiene and SPN sprawl still leave Active Directory exposed to low-noise credential abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Kerberoasting Explained”.
Key questions
Q: What breaks when service accounts keep unnecessary SPNs in Active Directory?
A: Unnecessary SPNs create a Kerberoasting path that lets a valid domain user request tickets for accounts that no longer need them.
Q: Why does Kerberoasting remain risky even without elevated privileges?
A: Because the attacker only needs a normal domain account to request tickets, then works offline to recover the password hash.
Q: What signs indicate Kerberoasting activity in Active Directory?
A: Look for a single account making many Kerberos service ticket requests in a short period, requests for unusual targets, weak-encryption ticket indicators, or activity against a honeytoken service account.
Practitioner guidance
- Audit SPN registrations across service accounts Verify whether each SPN still maps to a live, required service.
- Reset weak service-account passwords Move high-risk service accounts to strong, unique passwords and shorten the time they remain unchanged when the account supports Kerberos authentication.
- Monitor for abnormal Kerberos ticket volume Alert on one account requesting many service tickets in a short period, especially when the target is a privileged service account or an account with weak encryption indicators.
Bottom line: Kerberoasting exploits ordinary Kerberos behaviour to turn service accounts into offline password-cracking targets.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:18 pm
Kerberoasting is really an SPN governance failure before it is a cracking technique. The attack works because service accounts are left with reachable SPNs and passwords that are weak enough to crack offline. That means the real control boundary is service-account lifecycle discipline, not only detective tooling. The practitioner conclusion is that every surviving SPN must justify its existence.
A question worth separating out:
Q: How should IAM teams prioritise Kerberoasting remediation versus other AD hardening work?
A: Prioritise the service accounts that combine SPNs, weak passwords, and high privilege, especially where the associated server or application has already been retired. That gives the fastest reduction in attacker leverage because it removes both the ticketing path and the offline cracking opportunity from the most exposed accounts.
👉 Read our full editorial: Kerberoasting still turns AD service accounts into privilege paths