Skip to main content
AS-REP Roasting targets AD accounts with “Do not require Kerberos preauthentication” enabled (the UF_DONT_REQUIRE_PREAUTH flag). The KDC hands back something encrypted with a key it never confirmed the requester should have, but needs less than Kerberoasting to pull off: not even a valid domain credential, just a username.

​
A Quick Pre-Authentication Refresher

Normal Kerberos authentication starts with the client proving it knows the account’s password before the KDC hands back anything useful: the client encrypts a timestamp with a key derived from the user’s password hash and sends that alongside the AS-REQ. The KDC decrypts it with the same derived key, if the result is a valid, recent timestamp, identity is proven, and only then does the KDC issue the TGT. Anyone who doesn’t know the password can’t produce that encrypted timestamp, so they never get past this step.

​
The Flaw: Pre-Authentication Disabled

An account with pre-auth disabled skips that proof entirely. The KDC simply trusts the username in the AS-REQ and replies with an AS-REP, no encrypted timestamp required, no check that the requester knows anything at all. Anyone on the network, authenticated or not, can send a raw AS-REQ for that username and get aAS-REP back.

​
What’s In the AS-REP

Part of that AS-REP is a session key, encrypted with a key derived from the target user’s own password hash, the same derivation Kerberos uses everywhere else (RC4-HMAC over the NTLM hash by default, or an AES-based derivation if the account is configured for it). That encrypted blob is the crackable artifact: pulled offline, there’s no lockout policy and no per-guess logging, just raw compute against the target’s password, exactly like a Kerberoasting TGS-REP.

​
AS-REP Roasting vs. Kerberoasting

​
Why This Is Ever Set

Pre-auth disabled is almost always either a legacy compatibility setting (older Kerberos clients/applications that don’t support pre-authentication), a misconfiguration carried over by copying an old template account, or a setting applied once for a specific reason and never revisited, it’s rarely intentional on a given user account.

​
Finding Vulnerable Accounts

​
PowerView

​
Native AD Module (No PowerView Needed)

​
Impacket

​
Harvesting the AS-REP

Collect Roastable accounts with impacket-GetNPUsers.py
If a valid credential is already in hand, add <domain>/<user>:<password> in place of the bare <domain>/ to authenticate the LDAP lookup and target the full user list automatically instead of guessing at one.

​
Cracking the Hash

How to crack Hashes is fully covered on the Password Cracking page. Use the correct modes while cracking.