Kerberos Pre-Authentication Not Required

Accounts with DONT_REQ_PREAUTH set in userAccountControl will respond to an AS-REQ from any host without verifying the requestor's identity first. The KDC returns an AS-REP containing a blob encrypted with the account's password hash — no credentials required to obtain it. That blob is crackable offline.

The finding is the account configuration itself. Extraction and cracking are covered in AS-REP Roasting.

Detecting affected accounts

Identify all enabled accounts with DONT_REQ_PREAUTH set. The LDAP filter checks bit 23 of userAccountControl (decimal 4194304) while excluding disabled accounts (bit 1, decimal 2).

This extracts hashes but the output header lines identify the affected accounts — pipe to grep if you only want the usernames, not the hash material.

For a clean account list without requesting hash material:

Without -request, this lists accounts that have pre-auth disabled without pulling the actual AS-REP blobs.

Direct LDAP query via bloodyAD:

Pull memberOf and pwdLastSet alongside the account name. Both change the severity assessment.

Assessing severity

Not all pre-auth disabled accounts represent equal risk. The impact depends on what the account can do and how likely the password is to crack.

Check group membership for each affected account:

Accounts in Domain Admins, Enterprise Admins, Account Operators, or any tier-0 group are critical findings — a cracked password is immediate domain compromise. Accounts with no privileged membership are still a finding because cracked credentials give a foothold or lateral movement path.

Check password age:

pwdLastSet value of 0 means the password has never been changed since account creation — extremely likely to crack. A value several years old is also high risk.

Without credentials

If the domain allows unauthenticated LDAP bind, or if you have a username list from prior enumeration, pre-auth disabled accounts can be identified and hashed without any domain credentials. This is the most dangerous configuration variant.

Accounts that return a hash are confirmed pre-auth disabled. The hash is obtained with zero authentication — document this path separately, as it means the attack requires no prior access.

What this enables

A pre-auth disabled account on a domain-joined network means any machine with KDC reachability can request crackable material for that account. Cracked credentials give authenticated domain access.

For cracking and post-crack paths, see AS-REP Roasting and AD AS-REP Roasting.