AS-REP Roasting

Expanded Definition

AS-REP Roasting is a Kerberos abuse pattern in Active Directory where an attacker targets user accounts configured to skip preauthentication. Instead of proving possession of a password first, the attacker can request an authentication reply and then work offline against the returned encrypted material until the password is recovered. The technique is often discussed alongside other Kerberos misconfigurations, but it is distinct because the weakness is the account setting itself, not a flaw in Kerberos encryption.

Definitions vary across vendors on whether this should be treated as a credential attack, an identity misconfiguration, or a post-exploitation technique, but the operational risk is the same: one weak account configuration can expose a password to offline cracking. For broader identity governance context, the NIST Cybersecurity Framework 2.0 frames this as an access control and continuous monitoring issue, while NHI governance practices documented in Ultimate Guide to NHIs show how weak identity settings expand attack surface across environments.

The most common misapplication is assuming this only affects legacy user accounts, which occurs when security teams overlook service accounts, lab accounts, or dormant identities that still allow Kerberos requests.

Examples and Use Cases

Implementing detection and hardening for AS-REP Roasting rigorously often introduces operational friction, requiring organisations to balance stronger account policy enforcement against the risk of disrupting overlooked legacy workflows.

• A domain admin audit finds accounts with the preauthentication flag disabled, and those accounts are moved to normal Kerberos protection before exposure can be abused.
• A blue team monitors for unusual Kerberos AS-REP request patterns from endpoints that should not be enumerating domain users, then correlates the activity with lateral movement signals.
• An incident responder reviews password policy on a low-privilege account that was targeted offline, then resets the credential and removes the risky account configuration.
• A red team demonstrates that one misconfigured account can be used to extract crackable material without triggering repeated online login failures, making the weakness easy to miss in standard alerting.
• An identity engineer uses Ultimate Guide to NHIs to justify tighter lifecycle controls for machine and service identities, then aligns those controls with NIST Cybersecurity Framework 2.0 monitoring and access review practices.

Why It Matters in NHI Security

AS-REP Roasting matters because it shows how a single authentication setting can turn identity metadata into recoverable secrets. In NHI environments, that is especially dangerous because service accounts, automation identities, and other non-human accounts are often long-lived and poorly reviewed. NHIMG reports that 97% of NHIs carry excessive privileges, and 91.6% of secrets remain valid five days after notification, which underscores how quickly one compromised identity can become a durable foothold when governance is weak. The issue is not just password strength; it is the broader identity posture that allows weak accounts to persist unnoticed.

Practitioners should treat this as a signal to remove unnecessary preauthentication exemptions, strengthen account review processes, and watch for Kerberos activity that does not fit normal administrative behavior. NHI-focused controls in the Ultimate Guide to NHIs reinforce that identity sprawl and excessive privilege are usually what make a single exposed account become a larger compromise. Organisations typically encounter the business impact only after a low-privilege account is cracked and reused for access, at which point AS-REP Roasting becomes operationally unavoidable to address.